1 #include "qemu/osdep.h" 2 #include "target/arm/idau.h" 3 #include "trace.h" 4 #include "cpu.h" 5 #include "internals.h" 6 #include "exec/gdbstub.h" 7 #include "exec/helper-proto.h" 8 #include "qemu/host-utils.h" 9 #include "sysemu/arch_init.h" 10 #include "sysemu/sysemu.h" 11 #include "qemu/bitops.h" 12 #include "qemu/crc32c.h" 13 #include "qemu/qemu-print.h" 14 #include "exec/exec-all.h" 15 #include "exec/cpu_ldst.h" 16 #include "arm_ldst.h" 17 #include <zlib.h> /* For crc32 */ 18 #include "exec/semihost.h" 19 #include "sysemu/cpus.h" 20 #include "sysemu/kvm.h" 21 #include "fpu/softfloat.h" 22 #include "qemu/range.h" 23 #include "qapi/qapi-commands-target.h" 24 25 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 26 27 #ifndef CONFIG_USER_ONLY 28 /* Cacheability and shareability attributes for a memory access */ 29 typedef struct ARMCacheAttrs { 30 unsigned int attrs:8; /* as in the MAIR register encoding */ 31 unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */ 32 } ARMCacheAttrs; 33 34 static bool get_phys_addr(CPUARMState *env, target_ulong address, 35 MMUAccessType access_type, ARMMMUIdx mmu_idx, 36 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 37 target_ulong *page_size, 38 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 39 40 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 41 MMUAccessType access_type, ARMMMUIdx mmu_idx, 42 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 43 target_ulong *page_size_ptr, 44 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 45 46 /* Security attributes for an address, as returned by v8m_security_lookup. */ 47 typedef struct V8M_SAttributes { 48 bool subpage; /* true if these attrs don't cover the whole TARGET_PAGE */ 49 bool ns; 50 bool nsc; 51 uint8_t sregion; 52 bool srvalid; 53 uint8_t iregion; 54 bool irvalid; 55 } V8M_SAttributes; 56 57 static void v8m_security_lookup(CPUARMState *env, uint32_t address, 58 MMUAccessType access_type, ARMMMUIdx mmu_idx, 59 V8M_SAttributes *sattrs); 60 #endif 61 62 static void switch_mode(CPUARMState *env, int mode); 63 64 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 65 { 66 int nregs; 67 68 /* VFP data registers are always little-endian. */ 69 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 70 if (reg < nregs) { 71 stq_le_p(buf, *aa32_vfp_dreg(env, reg)); 72 return 8; 73 } 74 if (arm_feature(env, ARM_FEATURE_NEON)) { 75 /* Aliases for Q regs. */ 76 nregs += 16; 77 if (reg < nregs) { 78 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 79 stq_le_p(buf, q[0]); 80 stq_le_p(buf + 8, q[1]); 81 return 16; 82 } 83 } 84 switch (reg - nregs) { 85 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4; 86 case 1: stl_p(buf, vfp_get_fpscr(env)); return 4; 87 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4; 88 } 89 return 0; 90 } 91 92 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 93 { 94 int nregs; 95 96 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 97 if (reg < nregs) { 98 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf); 99 return 8; 100 } 101 if (arm_feature(env, ARM_FEATURE_NEON)) { 102 nregs += 16; 103 if (reg < nregs) { 104 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 105 q[0] = ldq_le_p(buf); 106 q[1] = ldq_le_p(buf + 8); 107 return 16; 108 } 109 } 110 switch (reg - nregs) { 111 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4; 112 case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4; 113 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4; 114 } 115 return 0; 116 } 117 118 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 119 { 120 switch (reg) { 121 case 0 ... 31: 122 /* 128 bit FP register */ 123 { 124 uint64_t *q = aa64_vfp_qreg(env, reg); 125 stq_le_p(buf, q[0]); 126 stq_le_p(buf + 8, q[1]); 127 return 16; 128 } 129 case 32: 130 /* FPSR */ 131 stl_p(buf, vfp_get_fpsr(env)); 132 return 4; 133 case 33: 134 /* FPCR */ 135 stl_p(buf, vfp_get_fpcr(env)); 136 return 4; 137 default: 138 return 0; 139 } 140 } 141 142 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 143 { 144 switch (reg) { 145 case 0 ... 31: 146 /* 128 bit FP register */ 147 { 148 uint64_t *q = aa64_vfp_qreg(env, reg); 149 q[0] = ldq_le_p(buf); 150 q[1] = ldq_le_p(buf + 8); 151 return 16; 152 } 153 case 32: 154 /* FPSR */ 155 vfp_set_fpsr(env, ldl_p(buf)); 156 return 4; 157 case 33: 158 /* FPCR */ 159 vfp_set_fpcr(env, ldl_p(buf)); 160 return 4; 161 default: 162 return 0; 163 } 164 } 165 166 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 167 { 168 assert(ri->fieldoffset); 169 if (cpreg_field_is_64bit(ri)) { 170 return CPREG_FIELD64(env, ri); 171 } else { 172 return CPREG_FIELD32(env, ri); 173 } 174 } 175 176 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 177 uint64_t value) 178 { 179 assert(ri->fieldoffset); 180 if (cpreg_field_is_64bit(ri)) { 181 CPREG_FIELD64(env, ri) = value; 182 } else { 183 CPREG_FIELD32(env, ri) = value; 184 } 185 } 186 187 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 188 { 189 return (char *)env + ri->fieldoffset; 190 } 191 192 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 193 { 194 /* Raw read of a coprocessor register (as needed for migration, etc). */ 195 if (ri->type & ARM_CP_CONST) { 196 return ri->resetvalue; 197 } else if (ri->raw_readfn) { 198 return ri->raw_readfn(env, ri); 199 } else if (ri->readfn) { 200 return ri->readfn(env, ri); 201 } else { 202 return raw_read(env, ri); 203 } 204 } 205 206 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 207 uint64_t v) 208 { 209 /* Raw write of a coprocessor register (as needed for migration, etc). 210 * Note that constant registers are treated as write-ignored; the 211 * caller should check for success by whether a readback gives the 212 * value written. 213 */ 214 if (ri->type & ARM_CP_CONST) { 215 return; 216 } else if (ri->raw_writefn) { 217 ri->raw_writefn(env, ri, v); 218 } else if (ri->writefn) { 219 ri->writefn(env, ri, v); 220 } else { 221 raw_write(env, ri, v); 222 } 223 } 224 225 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg) 226 { 227 ARMCPU *cpu = arm_env_get_cpu(env); 228 const ARMCPRegInfo *ri; 229 uint32_t key; 230 231 key = cpu->dyn_xml.cpregs_keys[reg]; 232 ri = get_arm_cp_reginfo(cpu->cp_regs, key); 233 if (ri) { 234 if (cpreg_field_is_64bit(ri)) { 235 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri)); 236 } else { 237 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri)); 238 } 239 } 240 return 0; 241 } 242 243 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg) 244 { 245 return 0; 246 } 247 248 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 249 { 250 /* Return true if the regdef would cause an assertion if you called 251 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 252 * program bug for it not to have the NO_RAW flag). 253 * NB that returning false here doesn't necessarily mean that calling 254 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 255 * read/write access functions which are safe for raw use" from "has 256 * read/write access functions which have side effects but has forgotten 257 * to provide raw access functions". 258 * The tests here line up with the conditions in read/write_raw_cp_reg() 259 * and assertions in raw_read()/raw_write(). 260 */ 261 if ((ri->type & ARM_CP_CONST) || 262 ri->fieldoffset || 263 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 264 return false; 265 } 266 return true; 267 } 268 269 bool write_cpustate_to_list(ARMCPU *cpu) 270 { 271 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 272 int i; 273 bool ok = true; 274 275 for (i = 0; i < cpu->cpreg_array_len; i++) { 276 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 277 const ARMCPRegInfo *ri; 278 279 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 280 if (!ri) { 281 ok = false; 282 continue; 283 } 284 if (ri->type & ARM_CP_NO_RAW) { 285 continue; 286 } 287 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri); 288 } 289 return ok; 290 } 291 292 bool write_list_to_cpustate(ARMCPU *cpu) 293 { 294 int i; 295 bool ok = true; 296 297 for (i = 0; i < cpu->cpreg_array_len; i++) { 298 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 299 uint64_t v = cpu->cpreg_values[i]; 300 const ARMCPRegInfo *ri; 301 302 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 303 if (!ri) { 304 ok = false; 305 continue; 306 } 307 if (ri->type & ARM_CP_NO_RAW) { 308 continue; 309 } 310 /* Write value and confirm it reads back as written 311 * (to catch read-only registers and partially read-only 312 * registers where the incoming migration value doesn't match) 313 */ 314 write_raw_cp_reg(&cpu->env, ri, v); 315 if (read_raw_cp_reg(&cpu->env, ri) != v) { 316 ok = false; 317 } 318 } 319 return ok; 320 } 321 322 static void add_cpreg_to_list(gpointer key, gpointer opaque) 323 { 324 ARMCPU *cpu = opaque; 325 uint64_t regidx; 326 const ARMCPRegInfo *ri; 327 328 regidx = *(uint32_t *)key; 329 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 330 331 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 332 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 333 /* The value array need not be initialized at this point */ 334 cpu->cpreg_array_len++; 335 } 336 } 337 338 static void count_cpreg(gpointer key, gpointer opaque) 339 { 340 ARMCPU *cpu = opaque; 341 uint64_t regidx; 342 const ARMCPRegInfo *ri; 343 344 regidx = *(uint32_t *)key; 345 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 346 347 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 348 cpu->cpreg_array_len++; 349 } 350 } 351 352 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 353 { 354 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a); 355 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b); 356 357 if (aidx > bidx) { 358 return 1; 359 } 360 if (aidx < bidx) { 361 return -1; 362 } 363 return 0; 364 } 365 366 void init_cpreg_list(ARMCPU *cpu) 367 { 368 /* Initialise the cpreg_tuples[] array based on the cp_regs hash. 369 * Note that we require cpreg_tuples[] to be sorted by key ID. 370 */ 371 GList *keys; 372 int arraylen; 373 374 keys = g_hash_table_get_keys(cpu->cp_regs); 375 keys = g_list_sort(keys, cpreg_key_compare); 376 377 cpu->cpreg_array_len = 0; 378 379 g_list_foreach(keys, count_cpreg, cpu); 380 381 arraylen = cpu->cpreg_array_len; 382 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 383 cpu->cpreg_values = g_new(uint64_t, arraylen); 384 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 385 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 386 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 387 cpu->cpreg_array_len = 0; 388 389 g_list_foreach(keys, add_cpreg_to_list, cpu); 390 391 assert(cpu->cpreg_array_len == arraylen); 392 393 g_list_free(keys); 394 } 395 396 /* 397 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but 398 * they are accessible when EL3 is using AArch64 regardless of EL3.NS. 399 * 400 * access_el3_aa32ns: Used to check AArch32 register views. 401 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views. 402 */ 403 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 404 const ARMCPRegInfo *ri, 405 bool isread) 406 { 407 bool secure = arm_is_secure_below_el3(env); 408 409 assert(!arm_el_is_aa64(env, 3)); 410 if (secure) { 411 return CP_ACCESS_TRAP_UNCATEGORIZED; 412 } 413 return CP_ACCESS_OK; 414 } 415 416 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env, 417 const ARMCPRegInfo *ri, 418 bool isread) 419 { 420 if (!arm_el_is_aa64(env, 3)) { 421 return access_el3_aa32ns(env, ri, isread); 422 } 423 return CP_ACCESS_OK; 424 } 425 426 /* Some secure-only AArch32 registers trap to EL3 if used from 427 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 428 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 429 * We assume that the .access field is set to PL1_RW. 430 */ 431 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 432 const ARMCPRegInfo *ri, 433 bool isread) 434 { 435 if (arm_current_el(env) == 3) { 436 return CP_ACCESS_OK; 437 } 438 if (arm_is_secure_below_el3(env)) { 439 return CP_ACCESS_TRAP_EL3; 440 } 441 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 442 return CP_ACCESS_TRAP_UNCATEGORIZED; 443 } 444 445 /* Check for traps to "powerdown debug" registers, which are controlled 446 * by MDCR.TDOSA 447 */ 448 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, 449 bool isread) 450 { 451 int el = arm_current_el(env); 452 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) || 453 (env->cp15.mdcr_el2 & MDCR_TDE) || 454 (arm_hcr_el2_eff(env) & HCR_TGE); 455 456 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) { 457 return CP_ACCESS_TRAP_EL2; 458 } 459 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { 460 return CP_ACCESS_TRAP_EL3; 461 } 462 return CP_ACCESS_OK; 463 } 464 465 /* Check for traps to "debug ROM" registers, which are controlled 466 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. 467 */ 468 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, 469 bool isread) 470 { 471 int el = arm_current_el(env); 472 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) || 473 (env->cp15.mdcr_el2 & MDCR_TDE) || 474 (arm_hcr_el2_eff(env) & HCR_TGE); 475 476 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) { 477 return CP_ACCESS_TRAP_EL2; 478 } 479 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 480 return CP_ACCESS_TRAP_EL3; 481 } 482 return CP_ACCESS_OK; 483 } 484 485 /* Check for traps to general debug registers, which are controlled 486 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. 487 */ 488 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, 489 bool isread) 490 { 491 int el = arm_current_el(env); 492 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) || 493 (env->cp15.mdcr_el2 & MDCR_TDE) || 494 (arm_hcr_el2_eff(env) & HCR_TGE); 495 496 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) { 497 return CP_ACCESS_TRAP_EL2; 498 } 499 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 500 return CP_ACCESS_TRAP_EL3; 501 } 502 return CP_ACCESS_OK; 503 } 504 505 /* Check for traps to performance monitor registers, which are controlled 506 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 507 */ 508 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 509 bool isread) 510 { 511 int el = arm_current_el(env); 512 513 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 514 && !arm_is_secure_below_el3(env)) { 515 return CP_ACCESS_TRAP_EL2; 516 } 517 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 518 return CP_ACCESS_TRAP_EL3; 519 } 520 return CP_ACCESS_OK; 521 } 522 523 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 524 { 525 ARMCPU *cpu = arm_env_get_cpu(env); 526 527 raw_write(env, ri, value); 528 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 529 } 530 531 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 532 { 533 ARMCPU *cpu = arm_env_get_cpu(env); 534 535 if (raw_read(env, ri) != value) { 536 /* Unlike real hardware the qemu TLB uses virtual addresses, 537 * not modified virtual addresses, so this causes a TLB flush. 538 */ 539 tlb_flush(CPU(cpu)); 540 raw_write(env, ri, value); 541 } 542 } 543 544 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 545 uint64_t value) 546 { 547 ARMCPU *cpu = arm_env_get_cpu(env); 548 549 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 550 && !extended_addresses_enabled(env)) { 551 /* For VMSA (when not using the LPAE long descriptor page table 552 * format) this register includes the ASID, so do a TLB flush. 553 * For PMSA it is purely a process ID and no action is needed. 554 */ 555 tlb_flush(CPU(cpu)); 556 } 557 raw_write(env, ri, value); 558 } 559 560 /* IS variants of TLB operations must affect all cores */ 561 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 562 uint64_t value) 563 { 564 CPUState *cs = ENV_GET_CPU(env); 565 566 tlb_flush_all_cpus_synced(cs); 567 } 568 569 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 570 uint64_t value) 571 { 572 CPUState *cs = ENV_GET_CPU(env); 573 574 tlb_flush_all_cpus_synced(cs); 575 } 576 577 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 578 uint64_t value) 579 { 580 CPUState *cs = ENV_GET_CPU(env); 581 582 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 583 } 584 585 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 586 uint64_t value) 587 { 588 CPUState *cs = ENV_GET_CPU(env); 589 590 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 591 } 592 593 /* 594 * Non-IS variants of TLB operations are upgraded to 595 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to 596 * force broadcast of these operations. 597 */ 598 static bool tlb_force_broadcast(CPUARMState *env) 599 { 600 return (env->cp15.hcr_el2 & HCR_FB) && 601 arm_current_el(env) == 1 && arm_is_secure_below_el3(env); 602 } 603 604 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 605 uint64_t value) 606 { 607 /* Invalidate all (TLBIALL) */ 608 ARMCPU *cpu = arm_env_get_cpu(env); 609 610 if (tlb_force_broadcast(env)) { 611 tlbiall_is_write(env, NULL, value); 612 return; 613 } 614 615 tlb_flush(CPU(cpu)); 616 } 617 618 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 619 uint64_t value) 620 { 621 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 622 ARMCPU *cpu = arm_env_get_cpu(env); 623 624 if (tlb_force_broadcast(env)) { 625 tlbimva_is_write(env, NULL, value); 626 return; 627 } 628 629 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 630 } 631 632 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 633 uint64_t value) 634 { 635 /* Invalidate by ASID (TLBIASID) */ 636 ARMCPU *cpu = arm_env_get_cpu(env); 637 638 if (tlb_force_broadcast(env)) { 639 tlbiasid_is_write(env, NULL, value); 640 return; 641 } 642 643 tlb_flush(CPU(cpu)); 644 } 645 646 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 647 uint64_t value) 648 { 649 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 650 ARMCPU *cpu = arm_env_get_cpu(env); 651 652 if (tlb_force_broadcast(env)) { 653 tlbimvaa_is_write(env, NULL, value); 654 return; 655 } 656 657 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 658 } 659 660 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 661 uint64_t value) 662 { 663 CPUState *cs = ENV_GET_CPU(env); 664 665 tlb_flush_by_mmuidx(cs, 666 ARMMMUIdxBit_S12NSE1 | 667 ARMMMUIdxBit_S12NSE0 | 668 ARMMMUIdxBit_S2NS); 669 } 670 671 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 672 uint64_t value) 673 { 674 CPUState *cs = ENV_GET_CPU(env); 675 676 tlb_flush_by_mmuidx_all_cpus_synced(cs, 677 ARMMMUIdxBit_S12NSE1 | 678 ARMMMUIdxBit_S12NSE0 | 679 ARMMMUIdxBit_S2NS); 680 } 681 682 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri, 683 uint64_t value) 684 { 685 /* Invalidate by IPA. This has to invalidate any structures that 686 * contain only stage 2 translation information, but does not need 687 * to apply to structures that contain combined stage 1 and stage 2 688 * translation information. 689 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 690 */ 691 CPUState *cs = ENV_GET_CPU(env); 692 uint64_t pageaddr; 693 694 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 695 return; 696 } 697 698 pageaddr = sextract64(value << 12, 0, 40); 699 700 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 701 } 702 703 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 704 uint64_t value) 705 { 706 CPUState *cs = ENV_GET_CPU(env); 707 uint64_t pageaddr; 708 709 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 710 return; 711 } 712 713 pageaddr = sextract64(value << 12, 0, 40); 714 715 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 716 ARMMMUIdxBit_S2NS); 717 } 718 719 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 720 uint64_t value) 721 { 722 CPUState *cs = ENV_GET_CPU(env); 723 724 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 725 } 726 727 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 728 uint64_t value) 729 { 730 CPUState *cs = ENV_GET_CPU(env); 731 732 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 733 } 734 735 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 736 uint64_t value) 737 { 738 CPUState *cs = ENV_GET_CPU(env); 739 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 740 741 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 742 } 743 744 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 745 uint64_t value) 746 { 747 CPUState *cs = ENV_GET_CPU(env); 748 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 749 750 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 751 ARMMMUIdxBit_S1E2); 752 } 753 754 static const ARMCPRegInfo cp_reginfo[] = { 755 /* Define the secure and non-secure FCSE identifier CP registers 756 * separately because there is no secure bank in V8 (no _EL3). This allows 757 * the secure register to be properly reset and migrated. There is also no 758 * v8 EL1 version of the register so the non-secure instance stands alone. 759 */ 760 { .name = "FCSEIDR", 761 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 762 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 763 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 764 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 765 { .name = "FCSEIDR_S", 766 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 767 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 768 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 769 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 770 /* Define the secure and non-secure context identifier CP registers 771 * separately because there is no secure bank in V8 (no _EL3). This allows 772 * the secure register to be properly reset and migrated. In the 773 * non-secure case, the 32-bit register will have reset and migration 774 * disabled during registration as it is handled by the 64-bit instance. 775 */ 776 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 777 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 778 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 779 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 780 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 781 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 782 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 783 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 784 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 785 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 786 REGINFO_SENTINEL 787 }; 788 789 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 790 /* NB: Some of these registers exist in v8 but with more precise 791 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 792 */ 793 /* MMU Domain access control / MPU write buffer control */ 794 { .name = "DACR", 795 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 796 .access = PL1_RW, .resetvalue = 0, 797 .writefn = dacr_write, .raw_writefn = raw_write, 798 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 799 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 800 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 801 * For v6 and v5, these mappings are overly broad. 802 */ 803 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 804 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 805 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 806 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 807 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 808 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 809 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 810 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 811 /* Cache maintenance ops; some of this space may be overridden later. */ 812 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 813 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 814 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 815 REGINFO_SENTINEL 816 }; 817 818 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 819 /* Not all pre-v6 cores implemented this WFI, so this is slightly 820 * over-broad. 821 */ 822 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 823 .access = PL1_W, .type = ARM_CP_WFI }, 824 REGINFO_SENTINEL 825 }; 826 827 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 828 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 829 * is UNPREDICTABLE; we choose to NOP as most implementations do). 830 */ 831 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 832 .access = PL1_W, .type = ARM_CP_WFI }, 833 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice 834 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 835 * OMAPCP will override this space. 836 */ 837 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 838 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 839 .resetvalue = 0 }, 840 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 841 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 842 .resetvalue = 0 }, 843 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 844 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 845 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 846 .resetvalue = 0 }, 847 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 848 * implementing it as RAZ means the "debug architecture version" bits 849 * will read as a reserved value, which should cause Linux to not try 850 * to use the debug hardware. 851 */ 852 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 853 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 854 /* MMU TLB control. Note that the wildcarding means we cover not just 855 * the unified TLB ops but also the dside/iside/inner-shareable variants. 856 */ 857 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 858 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 859 .type = ARM_CP_NO_RAW }, 860 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 861 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 862 .type = ARM_CP_NO_RAW }, 863 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 864 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 865 .type = ARM_CP_NO_RAW }, 866 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 867 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 868 .type = ARM_CP_NO_RAW }, 869 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 870 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 871 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 872 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 873 REGINFO_SENTINEL 874 }; 875 876 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 877 uint64_t value) 878 { 879 uint32_t mask = 0; 880 881 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 882 if (!arm_feature(env, ARM_FEATURE_V8)) { 883 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 884 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 885 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 886 */ 887 if (arm_feature(env, ARM_FEATURE_VFP)) { 888 /* VFP coprocessor: cp10 & cp11 [23:20] */ 889 mask |= (1 << 31) | (1 << 30) | (0xf << 20); 890 891 if (!arm_feature(env, ARM_FEATURE_NEON)) { 892 /* ASEDIS [31] bit is RAO/WI */ 893 value |= (1 << 31); 894 } 895 896 /* VFPv3 and upwards with NEON implement 32 double precision 897 * registers (D0-D31). 898 */ 899 if (!arm_feature(env, ARM_FEATURE_NEON) || 900 !arm_feature(env, ARM_FEATURE_VFP3)) { 901 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 902 value |= (1 << 30); 903 } 904 } 905 value &= mask; 906 } 907 env->cp15.cpacr_el1 = value; 908 } 909 910 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 911 { 912 /* Call cpacr_write() so that we reset with the correct RAO bits set 913 * for our CPU features. 914 */ 915 cpacr_write(env, ri, 0); 916 } 917 918 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 919 bool isread) 920 { 921 if (arm_feature(env, ARM_FEATURE_V8)) { 922 /* Check if CPACR accesses are to be trapped to EL2 */ 923 if (arm_current_el(env) == 1 && 924 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) { 925 return CP_ACCESS_TRAP_EL2; 926 /* Check if CPACR accesses are to be trapped to EL3 */ 927 } else if (arm_current_el(env) < 3 && 928 (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 929 return CP_ACCESS_TRAP_EL3; 930 } 931 } 932 933 return CP_ACCESS_OK; 934 } 935 936 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 937 bool isread) 938 { 939 /* Check if CPTR accesses are set to trap to EL3 */ 940 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 941 return CP_ACCESS_TRAP_EL3; 942 } 943 944 return CP_ACCESS_OK; 945 } 946 947 static const ARMCPRegInfo v6_cp_reginfo[] = { 948 /* prefetch by MVA in v6, NOP in v7 */ 949 { .name = "MVA_prefetch", 950 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 951 .access = PL1_W, .type = ARM_CP_NOP }, 952 /* We need to break the TB after ISB to execute self-modifying code 953 * correctly and also to take any pending interrupts immediately. 954 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 955 */ 956 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 957 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 958 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 959 .access = PL0_W, .type = ARM_CP_NOP }, 960 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 961 .access = PL0_W, .type = ARM_CP_NOP }, 962 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 963 .access = PL1_RW, 964 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 965 offsetof(CPUARMState, cp15.ifar_ns) }, 966 .resetvalue = 0, }, 967 /* Watchpoint Fault Address Register : should actually only be present 968 * for 1136, 1176, 11MPCore. 969 */ 970 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 971 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 972 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 973 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 974 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 975 .resetfn = cpacr_reset, .writefn = cpacr_write }, 976 REGINFO_SENTINEL 977 }; 978 979 /* Definitions for the PMU registers */ 980 #define PMCRN_MASK 0xf800 981 #define PMCRN_SHIFT 11 982 #define PMCRLC 0x40 983 #define PMCRDP 0x10 984 #define PMCRD 0x8 985 #define PMCRC 0x4 986 #define PMCRP 0x2 987 #define PMCRE 0x1 988 989 #define PMXEVTYPER_P 0x80000000 990 #define PMXEVTYPER_U 0x40000000 991 #define PMXEVTYPER_NSK 0x20000000 992 #define PMXEVTYPER_NSU 0x10000000 993 #define PMXEVTYPER_NSH 0x08000000 994 #define PMXEVTYPER_M 0x04000000 995 #define PMXEVTYPER_MT 0x02000000 996 #define PMXEVTYPER_EVTCOUNT 0x0000ffff 997 #define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \ 998 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \ 999 PMXEVTYPER_M | PMXEVTYPER_MT | \ 1000 PMXEVTYPER_EVTCOUNT) 1001 1002 #define PMCCFILTR 0xf8000000 1003 #define PMCCFILTR_M PMXEVTYPER_M 1004 #define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M) 1005 1006 static inline uint32_t pmu_num_counters(CPUARMState *env) 1007 { 1008 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT; 1009 } 1010 1011 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */ 1012 static inline uint64_t pmu_counter_mask(CPUARMState *env) 1013 { 1014 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1); 1015 } 1016 1017 typedef struct pm_event { 1018 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 1019 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 1020 bool (*supported)(CPUARMState *); 1021 /* 1022 * Retrieve the current count of the underlying event. The programmed 1023 * counters hold a difference from the return value from this function 1024 */ 1025 uint64_t (*get_count)(CPUARMState *); 1026 /* 1027 * Return how many nanoseconds it will take (at a minimum) for count events 1028 * to occur. A negative value indicates the counter will never overflow, or 1029 * that the counter has otherwise arranged for the overflow bit to be set 1030 * and the PMU interrupt to be raised on overflow. 1031 */ 1032 int64_t (*ns_per_count)(uint64_t); 1033 } pm_event; 1034 1035 static bool event_always_supported(CPUARMState *env) 1036 { 1037 return true; 1038 } 1039 1040 static uint64_t swinc_get_count(CPUARMState *env) 1041 { 1042 /* 1043 * SW_INCR events are written directly to the pmevcntr's by writes to 1044 * PMSWINC, so there is no underlying count maintained by the PMU itself 1045 */ 1046 return 0; 1047 } 1048 1049 static int64_t swinc_ns_per(uint64_t ignored) 1050 { 1051 return -1; 1052 } 1053 1054 /* 1055 * Return the underlying cycle count for the PMU cycle counters. If we're in 1056 * usermode, simply return 0. 1057 */ 1058 static uint64_t cycles_get_count(CPUARMState *env) 1059 { 1060 #ifndef CONFIG_USER_ONLY 1061 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1062 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 1063 #else 1064 return cpu_get_host_ticks(); 1065 #endif 1066 } 1067 1068 #ifndef CONFIG_USER_ONLY 1069 static int64_t cycles_ns_per(uint64_t cycles) 1070 { 1071 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 1072 } 1073 1074 static bool instructions_supported(CPUARMState *env) 1075 { 1076 return use_icount == 1 /* Precise instruction counting */; 1077 } 1078 1079 static uint64_t instructions_get_count(CPUARMState *env) 1080 { 1081 return (uint64_t)cpu_get_icount_raw(); 1082 } 1083 1084 static int64_t instructions_ns_per(uint64_t icount) 1085 { 1086 return cpu_icount_to_ns((int64_t)icount); 1087 } 1088 #endif 1089 1090 static const pm_event pm_events[] = { 1091 { .number = 0x000, /* SW_INCR */ 1092 .supported = event_always_supported, 1093 .get_count = swinc_get_count, 1094 .ns_per_count = swinc_ns_per, 1095 }, 1096 #ifndef CONFIG_USER_ONLY 1097 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 1098 .supported = instructions_supported, 1099 .get_count = instructions_get_count, 1100 .ns_per_count = instructions_ns_per, 1101 }, 1102 { .number = 0x011, /* CPU_CYCLES, Cycle */ 1103 .supported = event_always_supported, 1104 .get_count = cycles_get_count, 1105 .ns_per_count = cycles_ns_per, 1106 } 1107 #endif 1108 }; 1109 1110 /* 1111 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1112 * events (i.e. the statistical profiling extension), this implementation 1113 * should first be updated to something sparse instead of the current 1114 * supported_event_map[] array. 1115 */ 1116 #define MAX_EVENT_ID 0x11 1117 #define UNSUPPORTED_EVENT UINT16_MAX 1118 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1119 1120 /* 1121 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 1122 * of ARM event numbers to indices in our pm_events array. 1123 * 1124 * Note: Events in the 0x40XX range are not currently supported. 1125 */ 1126 void pmu_init(ARMCPU *cpu) 1127 { 1128 unsigned int i; 1129 1130 /* 1131 * Empty supported_event_map and cpu->pmceid[01] before adding supported 1132 * events to them 1133 */ 1134 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1135 supported_event_map[i] = UNSUPPORTED_EVENT; 1136 } 1137 cpu->pmceid0 = 0; 1138 cpu->pmceid1 = 0; 1139 1140 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1141 const pm_event *cnt = &pm_events[i]; 1142 assert(cnt->number <= MAX_EVENT_ID); 1143 /* We do not currently support events in the 0x40xx range */ 1144 assert(cnt->number <= 0x3f); 1145 1146 if (cnt->supported(&cpu->env)) { 1147 supported_event_map[cnt->number] = i; 1148 uint64_t event_mask = 1ULL << (cnt->number & 0x1f); 1149 if (cnt->number & 0x20) { 1150 cpu->pmceid1 |= event_mask; 1151 } else { 1152 cpu->pmceid0 |= event_mask; 1153 } 1154 } 1155 } 1156 } 1157 1158 /* 1159 * Check at runtime whether a PMU event is supported for the current machine 1160 */ 1161 static bool event_supported(uint16_t number) 1162 { 1163 if (number > MAX_EVENT_ID) { 1164 return false; 1165 } 1166 return supported_event_map[number] != UNSUPPORTED_EVENT; 1167 } 1168 1169 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1170 bool isread) 1171 { 1172 /* Performance monitor registers user accessibility is controlled 1173 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1174 * trapping to EL2 or EL3 for other accesses. 1175 */ 1176 int el = arm_current_el(env); 1177 1178 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1179 return CP_ACCESS_TRAP; 1180 } 1181 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 1182 && !arm_is_secure_below_el3(env)) { 1183 return CP_ACCESS_TRAP_EL2; 1184 } 1185 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1186 return CP_ACCESS_TRAP_EL3; 1187 } 1188 1189 return CP_ACCESS_OK; 1190 } 1191 1192 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1193 const ARMCPRegInfo *ri, 1194 bool isread) 1195 { 1196 /* ER: event counter read trap control */ 1197 if (arm_feature(env, ARM_FEATURE_V8) 1198 && arm_current_el(env) == 0 1199 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1200 && isread) { 1201 return CP_ACCESS_OK; 1202 } 1203 1204 return pmreg_access(env, ri, isread); 1205 } 1206 1207 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1208 const ARMCPRegInfo *ri, 1209 bool isread) 1210 { 1211 /* SW: software increment write trap control */ 1212 if (arm_feature(env, ARM_FEATURE_V8) 1213 && arm_current_el(env) == 0 1214 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1215 && !isread) { 1216 return CP_ACCESS_OK; 1217 } 1218 1219 return pmreg_access(env, ri, isread); 1220 } 1221 1222 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1223 const ARMCPRegInfo *ri, 1224 bool isread) 1225 { 1226 /* ER: event counter read trap control */ 1227 if (arm_feature(env, ARM_FEATURE_V8) 1228 && arm_current_el(env) == 0 1229 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1230 return CP_ACCESS_OK; 1231 } 1232 1233 return pmreg_access(env, ri, isread); 1234 } 1235 1236 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1237 const ARMCPRegInfo *ri, 1238 bool isread) 1239 { 1240 /* CR: cycle counter read trap control */ 1241 if (arm_feature(env, ARM_FEATURE_V8) 1242 && arm_current_el(env) == 0 1243 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1244 && isread) { 1245 return CP_ACCESS_OK; 1246 } 1247 1248 return pmreg_access(env, ri, isread); 1249 } 1250 1251 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using 1252 * the current EL, security state, and register configuration. 1253 */ 1254 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1255 { 1256 uint64_t filter; 1257 bool e, p, u, nsk, nsu, nsh, m; 1258 bool enabled, prohibited, filtered; 1259 bool secure = arm_is_secure(env); 1260 int el = arm_current_el(env); 1261 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1262 1263 if (!arm_feature(env, ARM_FEATURE_PMU)) { 1264 return false; 1265 } 1266 1267 if (!arm_feature(env, ARM_FEATURE_EL2) || 1268 (counter < hpmn || counter == 31)) { 1269 e = env->cp15.c9_pmcr & PMCRE; 1270 } else { 1271 e = env->cp15.mdcr_el2 & MDCR_HPME; 1272 } 1273 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1274 1275 if (!secure) { 1276 if (el == 2 && (counter < hpmn || counter == 31)) { 1277 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD; 1278 } else { 1279 prohibited = false; 1280 } 1281 } else { 1282 prohibited = arm_feature(env, ARM_FEATURE_EL3) && 1283 (env->cp15.mdcr_el3 & MDCR_SPME); 1284 } 1285 1286 if (prohibited && counter == 31) { 1287 prohibited = env->cp15.c9_pmcr & PMCRDP; 1288 } 1289 1290 if (counter == 31) { 1291 filter = env->cp15.pmccfiltr_el0; 1292 } else { 1293 filter = env->cp15.c14_pmevtyper[counter]; 1294 } 1295 1296 p = filter & PMXEVTYPER_P; 1297 u = filter & PMXEVTYPER_U; 1298 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1299 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1300 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1301 m = arm_el_is_aa64(env, 1) && 1302 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1303 1304 if (el == 0) { 1305 filtered = secure ? u : u != nsu; 1306 } else if (el == 1) { 1307 filtered = secure ? p : p != nsk; 1308 } else if (el == 2) { 1309 filtered = !nsh; 1310 } else { /* EL3 */ 1311 filtered = m != p; 1312 } 1313 1314 if (counter != 31) { 1315 /* 1316 * If not checking PMCCNTR, ensure the counter is setup to an event we 1317 * support 1318 */ 1319 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1320 if (!event_supported(event)) { 1321 return false; 1322 } 1323 } 1324 1325 return enabled && !prohibited && !filtered; 1326 } 1327 1328 static void pmu_update_irq(CPUARMState *env) 1329 { 1330 ARMCPU *cpu = arm_env_get_cpu(env); 1331 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1332 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1333 } 1334 1335 /* 1336 * Ensure c15_ccnt is the guest-visible count so that operations such as 1337 * enabling/disabling the counter or filtering, modifying the count itself, 1338 * etc. can be done logically. This is essentially a no-op if the counter is 1339 * not enabled at the time of the call. 1340 */ 1341 static void pmccntr_op_start(CPUARMState *env) 1342 { 1343 uint64_t cycles = cycles_get_count(env); 1344 1345 if (pmu_counter_enabled(env, 31)) { 1346 uint64_t eff_cycles = cycles; 1347 if (env->cp15.c9_pmcr & PMCRD) { 1348 /* Increment once every 64 processor clock cycles */ 1349 eff_cycles /= 64; 1350 } 1351 1352 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1353 1354 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1355 1ull << 63 : 1ull << 31; 1356 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1357 env->cp15.c9_pmovsr |= (1 << 31); 1358 pmu_update_irq(env); 1359 } 1360 1361 env->cp15.c15_ccnt = new_pmccntr; 1362 } 1363 env->cp15.c15_ccnt_delta = cycles; 1364 } 1365 1366 /* 1367 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1368 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1369 * pmccntr_op_start. 1370 */ 1371 static void pmccntr_op_finish(CPUARMState *env) 1372 { 1373 if (pmu_counter_enabled(env, 31)) { 1374 #ifndef CONFIG_USER_ONLY 1375 /* Calculate when the counter will next overflow */ 1376 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1377 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1378 remaining_cycles = (uint32_t)remaining_cycles; 1379 } 1380 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1381 1382 if (overflow_in > 0) { 1383 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1384 overflow_in; 1385 ARMCPU *cpu = arm_env_get_cpu(env); 1386 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1387 } 1388 #endif 1389 1390 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1391 if (env->cp15.c9_pmcr & PMCRD) { 1392 /* Increment once every 64 processor clock cycles */ 1393 prev_cycles /= 64; 1394 } 1395 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1396 } 1397 } 1398 1399 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1400 { 1401 1402 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1403 uint64_t count = 0; 1404 if (event_supported(event)) { 1405 uint16_t event_idx = supported_event_map[event]; 1406 count = pm_events[event_idx].get_count(env); 1407 } 1408 1409 if (pmu_counter_enabled(env, counter)) { 1410 uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1411 1412 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) { 1413 env->cp15.c9_pmovsr |= (1 << counter); 1414 pmu_update_irq(env); 1415 } 1416 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1417 } 1418 env->cp15.c14_pmevcntr_delta[counter] = count; 1419 } 1420 1421 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1422 { 1423 if (pmu_counter_enabled(env, counter)) { 1424 #ifndef CONFIG_USER_ONLY 1425 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1426 uint16_t event_idx = supported_event_map[event]; 1427 uint64_t delta = UINT32_MAX - 1428 (uint32_t)env->cp15.c14_pmevcntr[counter] + 1; 1429 int64_t overflow_in = pm_events[event_idx].ns_per_count(delta); 1430 1431 if (overflow_in > 0) { 1432 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1433 overflow_in; 1434 ARMCPU *cpu = arm_env_get_cpu(env); 1435 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1436 } 1437 #endif 1438 1439 env->cp15.c14_pmevcntr_delta[counter] -= 1440 env->cp15.c14_pmevcntr[counter]; 1441 } 1442 } 1443 1444 void pmu_op_start(CPUARMState *env) 1445 { 1446 unsigned int i; 1447 pmccntr_op_start(env); 1448 for (i = 0; i < pmu_num_counters(env); i++) { 1449 pmevcntr_op_start(env, i); 1450 } 1451 } 1452 1453 void pmu_op_finish(CPUARMState *env) 1454 { 1455 unsigned int i; 1456 pmccntr_op_finish(env); 1457 for (i = 0; i < pmu_num_counters(env); i++) { 1458 pmevcntr_op_finish(env, i); 1459 } 1460 } 1461 1462 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1463 { 1464 pmu_op_start(&cpu->env); 1465 } 1466 1467 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1468 { 1469 pmu_op_finish(&cpu->env); 1470 } 1471 1472 void arm_pmu_timer_cb(void *opaque) 1473 { 1474 ARMCPU *cpu = opaque; 1475 1476 /* 1477 * Update all the counter values based on the current underlying counts, 1478 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1479 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1480 * counter may expire. 1481 */ 1482 pmu_op_start(&cpu->env); 1483 pmu_op_finish(&cpu->env); 1484 } 1485 1486 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1487 uint64_t value) 1488 { 1489 pmu_op_start(env); 1490 1491 if (value & PMCRC) { 1492 /* The counter has been reset */ 1493 env->cp15.c15_ccnt = 0; 1494 } 1495 1496 if (value & PMCRP) { 1497 unsigned int i; 1498 for (i = 0; i < pmu_num_counters(env); i++) { 1499 env->cp15.c14_pmevcntr[i] = 0; 1500 } 1501 } 1502 1503 /* only the DP, X, D and E bits are writable */ 1504 env->cp15.c9_pmcr &= ~0x39; 1505 env->cp15.c9_pmcr |= (value & 0x39); 1506 1507 pmu_op_finish(env); 1508 } 1509 1510 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1511 uint64_t value) 1512 { 1513 unsigned int i; 1514 for (i = 0; i < pmu_num_counters(env); i++) { 1515 /* Increment a counter's count iff: */ 1516 if ((value & (1 << i)) && /* counter's bit is set */ 1517 /* counter is enabled and not filtered */ 1518 pmu_counter_enabled(env, i) && 1519 /* counter is SW_INCR */ 1520 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1521 pmevcntr_op_start(env, i); 1522 1523 /* 1524 * Detect if this write causes an overflow since we can't predict 1525 * PMSWINC overflows like we can for other events 1526 */ 1527 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1528 1529 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) { 1530 env->cp15.c9_pmovsr |= (1 << i); 1531 pmu_update_irq(env); 1532 } 1533 1534 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1535 1536 pmevcntr_op_finish(env, i); 1537 } 1538 } 1539 } 1540 1541 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1542 { 1543 uint64_t ret; 1544 pmccntr_op_start(env); 1545 ret = env->cp15.c15_ccnt; 1546 pmccntr_op_finish(env); 1547 return ret; 1548 } 1549 1550 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1551 uint64_t value) 1552 { 1553 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1554 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1555 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1556 * accessed. 1557 */ 1558 env->cp15.c9_pmselr = value & 0x1f; 1559 } 1560 1561 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1562 uint64_t value) 1563 { 1564 pmccntr_op_start(env); 1565 env->cp15.c15_ccnt = value; 1566 pmccntr_op_finish(env); 1567 } 1568 1569 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1570 uint64_t value) 1571 { 1572 uint64_t cur_val = pmccntr_read(env, NULL); 1573 1574 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1575 } 1576 1577 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1578 uint64_t value) 1579 { 1580 pmccntr_op_start(env); 1581 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1582 pmccntr_op_finish(env); 1583 } 1584 1585 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1586 uint64_t value) 1587 { 1588 pmccntr_op_start(env); 1589 /* M is not accessible from AArch32 */ 1590 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1591 (value & PMCCFILTR); 1592 pmccntr_op_finish(env); 1593 } 1594 1595 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1596 { 1597 /* M is not visible in AArch32 */ 1598 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1599 } 1600 1601 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1602 uint64_t value) 1603 { 1604 value &= pmu_counter_mask(env); 1605 env->cp15.c9_pmcnten |= value; 1606 } 1607 1608 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1609 uint64_t value) 1610 { 1611 value &= pmu_counter_mask(env); 1612 env->cp15.c9_pmcnten &= ~value; 1613 } 1614 1615 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1616 uint64_t value) 1617 { 1618 value &= pmu_counter_mask(env); 1619 env->cp15.c9_pmovsr &= ~value; 1620 pmu_update_irq(env); 1621 } 1622 1623 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1624 uint64_t value) 1625 { 1626 value &= pmu_counter_mask(env); 1627 env->cp15.c9_pmovsr |= value; 1628 pmu_update_irq(env); 1629 } 1630 1631 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1632 uint64_t value, const uint8_t counter) 1633 { 1634 if (counter == 31) { 1635 pmccfiltr_write(env, ri, value); 1636 } else if (counter < pmu_num_counters(env)) { 1637 pmevcntr_op_start(env, counter); 1638 1639 /* 1640 * If this counter's event type is changing, store the current 1641 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1642 * pmevcntr_op_finish has the correct baseline when it converts back to 1643 * a delta. 1644 */ 1645 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1646 PMXEVTYPER_EVTCOUNT; 1647 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1648 if (old_event != new_event) { 1649 uint64_t count = 0; 1650 if (event_supported(new_event)) { 1651 uint16_t event_idx = supported_event_map[new_event]; 1652 count = pm_events[event_idx].get_count(env); 1653 } 1654 env->cp15.c14_pmevcntr_delta[counter] = count; 1655 } 1656 1657 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1658 pmevcntr_op_finish(env, counter); 1659 } 1660 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1661 * PMSELR value is equal to or greater than the number of implemented 1662 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1663 */ 1664 } 1665 1666 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1667 const uint8_t counter) 1668 { 1669 if (counter == 31) { 1670 return env->cp15.pmccfiltr_el0; 1671 } else if (counter < pmu_num_counters(env)) { 1672 return env->cp15.c14_pmevtyper[counter]; 1673 } else { 1674 /* 1675 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1676 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1677 */ 1678 return 0; 1679 } 1680 } 1681 1682 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1683 uint64_t value) 1684 { 1685 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1686 pmevtyper_write(env, ri, value, counter); 1687 } 1688 1689 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1690 uint64_t value) 1691 { 1692 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1693 env->cp15.c14_pmevtyper[counter] = value; 1694 1695 /* 1696 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1697 * pmu_op_finish calls when loading saved state for a migration. Because 1698 * we're potentially updating the type of event here, the value written to 1699 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a 1700 * different counter type. Therefore, we need to set this value to the 1701 * current count for the counter type we're writing so that pmu_op_finish 1702 * has the correct count for its calculation. 1703 */ 1704 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1705 if (event_supported(event)) { 1706 uint16_t event_idx = supported_event_map[event]; 1707 env->cp15.c14_pmevcntr_delta[counter] = 1708 pm_events[event_idx].get_count(env); 1709 } 1710 } 1711 1712 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1713 { 1714 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1715 return pmevtyper_read(env, ri, counter); 1716 } 1717 1718 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1719 uint64_t value) 1720 { 1721 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1722 } 1723 1724 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1725 { 1726 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1727 } 1728 1729 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1730 uint64_t value, uint8_t counter) 1731 { 1732 if (counter < pmu_num_counters(env)) { 1733 pmevcntr_op_start(env, counter); 1734 env->cp15.c14_pmevcntr[counter] = value; 1735 pmevcntr_op_finish(env, counter); 1736 } 1737 /* 1738 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1739 * are CONSTRAINED UNPREDICTABLE. 1740 */ 1741 } 1742 1743 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1744 uint8_t counter) 1745 { 1746 if (counter < pmu_num_counters(env)) { 1747 uint64_t ret; 1748 pmevcntr_op_start(env, counter); 1749 ret = env->cp15.c14_pmevcntr[counter]; 1750 pmevcntr_op_finish(env, counter); 1751 return ret; 1752 } else { 1753 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1754 * are CONSTRAINED UNPREDICTABLE. */ 1755 return 0; 1756 } 1757 } 1758 1759 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1760 uint64_t value) 1761 { 1762 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1763 pmevcntr_write(env, ri, value, counter); 1764 } 1765 1766 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1767 { 1768 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1769 return pmevcntr_read(env, ri, counter); 1770 } 1771 1772 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1773 uint64_t value) 1774 { 1775 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1776 assert(counter < pmu_num_counters(env)); 1777 env->cp15.c14_pmevcntr[counter] = value; 1778 pmevcntr_write(env, ri, value, counter); 1779 } 1780 1781 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1782 { 1783 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1784 assert(counter < pmu_num_counters(env)); 1785 return env->cp15.c14_pmevcntr[counter]; 1786 } 1787 1788 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1789 uint64_t value) 1790 { 1791 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1792 } 1793 1794 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1795 { 1796 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1797 } 1798 1799 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1800 uint64_t value) 1801 { 1802 if (arm_feature(env, ARM_FEATURE_V8)) { 1803 env->cp15.c9_pmuserenr = value & 0xf; 1804 } else { 1805 env->cp15.c9_pmuserenr = value & 1; 1806 } 1807 } 1808 1809 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1810 uint64_t value) 1811 { 1812 /* We have no event counters so only the C bit can be changed */ 1813 value &= pmu_counter_mask(env); 1814 env->cp15.c9_pminten |= value; 1815 pmu_update_irq(env); 1816 } 1817 1818 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1819 uint64_t value) 1820 { 1821 value &= pmu_counter_mask(env); 1822 env->cp15.c9_pminten &= ~value; 1823 pmu_update_irq(env); 1824 } 1825 1826 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1827 uint64_t value) 1828 { 1829 /* Note that even though the AArch64 view of this register has bits 1830 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1831 * architectural requirements for bits which are RES0 only in some 1832 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1833 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1834 */ 1835 raw_write(env, ri, value & ~0x1FULL); 1836 } 1837 1838 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1839 { 1840 /* Begin with base v8.0 state. */ 1841 uint32_t valid_mask = 0x3fff; 1842 ARMCPU *cpu = arm_env_get_cpu(env); 1843 1844 if (arm_el_is_aa64(env, 3)) { 1845 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */ 1846 valid_mask &= ~SCR_NET; 1847 } else { 1848 valid_mask &= ~(SCR_RW | SCR_ST); 1849 } 1850 1851 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1852 valid_mask &= ~SCR_HCE; 1853 1854 /* On ARMv7, SMD (or SCD as it is called in v7) is only 1855 * supported if EL2 exists. The bit is UNK/SBZP when 1856 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1857 * when EL2 is unavailable. 1858 * On ARMv8, this bit is always available. 1859 */ 1860 if (arm_feature(env, ARM_FEATURE_V7) && 1861 !arm_feature(env, ARM_FEATURE_V8)) { 1862 valid_mask &= ~SCR_SMD; 1863 } 1864 } 1865 if (cpu_isar_feature(aa64_lor, cpu)) { 1866 valid_mask |= SCR_TLOR; 1867 } 1868 if (cpu_isar_feature(aa64_pauth, cpu)) { 1869 valid_mask |= SCR_API | SCR_APK; 1870 } 1871 1872 /* Clear all-context RES0 bits. */ 1873 value &= valid_mask; 1874 raw_write(env, ri, value); 1875 } 1876 1877 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1878 { 1879 ARMCPU *cpu = arm_env_get_cpu(env); 1880 1881 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR 1882 * bank 1883 */ 1884 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1885 ri->secure & ARM_CP_SECSTATE_S); 1886 1887 return cpu->ccsidr[index]; 1888 } 1889 1890 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1891 uint64_t value) 1892 { 1893 raw_write(env, ri, value & 0xf); 1894 } 1895 1896 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1897 { 1898 CPUState *cs = ENV_GET_CPU(env); 1899 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 1900 uint64_t ret = 0; 1901 1902 if (hcr_el2 & HCR_IMO) { 1903 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1904 ret |= CPSR_I; 1905 } 1906 } else { 1907 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1908 ret |= CPSR_I; 1909 } 1910 } 1911 1912 if (hcr_el2 & HCR_FMO) { 1913 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1914 ret |= CPSR_F; 1915 } 1916 } else { 1917 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1918 ret |= CPSR_F; 1919 } 1920 } 1921 1922 /* External aborts are not possible in QEMU so A bit is always clear */ 1923 return ret; 1924 } 1925 1926 static const ARMCPRegInfo v7_cp_reginfo[] = { 1927 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 1928 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 1929 .access = PL1_W, .type = ARM_CP_NOP }, 1930 /* Performance monitors are implementation defined in v7, 1931 * but with an ARM recommended set of registers, which we 1932 * follow. 1933 * 1934 * Performance registers fall into three categories: 1935 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 1936 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 1937 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 1938 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 1939 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 1940 */ 1941 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 1942 .access = PL0_RW, .type = ARM_CP_ALIAS, 1943 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1944 .writefn = pmcntenset_write, 1945 .accessfn = pmreg_access, 1946 .raw_writefn = raw_write }, 1947 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, 1948 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 1949 .access = PL0_RW, .accessfn = pmreg_access, 1950 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 1951 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 1952 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 1953 .access = PL0_RW, 1954 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1955 .accessfn = pmreg_access, 1956 .writefn = pmcntenclr_write, 1957 .type = ARM_CP_ALIAS }, 1958 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 1959 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 1960 .access = PL0_RW, .accessfn = pmreg_access, 1961 .type = ARM_CP_ALIAS, 1962 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 1963 .writefn = pmcntenclr_write }, 1964 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 1965 .access = PL0_RW, .type = ARM_CP_IO, 1966 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 1967 .accessfn = pmreg_access, 1968 .writefn = pmovsr_write, 1969 .raw_writefn = raw_write }, 1970 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 1971 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 1972 .access = PL0_RW, .accessfn = pmreg_access, 1973 .type = ARM_CP_ALIAS | ARM_CP_IO, 1974 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 1975 .writefn = pmovsr_write, 1976 .raw_writefn = raw_write }, 1977 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 1978 .access = PL0_W, .accessfn = pmreg_access_swinc, 1979 .type = ARM_CP_NO_RAW | ARM_CP_IO, 1980 .writefn = pmswinc_write }, 1981 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 1982 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 1983 .access = PL0_W, .accessfn = pmreg_access_swinc, 1984 .type = ARM_CP_NO_RAW | ARM_CP_IO, 1985 .writefn = pmswinc_write }, 1986 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 1987 .access = PL0_RW, .type = ARM_CP_ALIAS, 1988 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 1989 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 1990 .raw_writefn = raw_write}, 1991 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 1992 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 1993 .access = PL0_RW, .accessfn = pmreg_access_selr, 1994 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 1995 .writefn = pmselr_write, .raw_writefn = raw_write, }, 1996 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 1997 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 1998 .readfn = pmccntr_read, .writefn = pmccntr_write32, 1999 .accessfn = pmreg_access_ccntr }, 2000 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 2001 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 2002 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 2003 .type = ARM_CP_IO, 2004 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 2005 .readfn = pmccntr_read, .writefn = pmccntr_write, 2006 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 2007 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 2008 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 2009 .access = PL0_RW, .accessfn = pmreg_access, 2010 .type = ARM_CP_ALIAS | ARM_CP_IO, 2011 .resetvalue = 0, }, 2012 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 2013 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 2014 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 2015 .access = PL0_RW, .accessfn = pmreg_access, 2016 .type = ARM_CP_IO, 2017 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 2018 .resetvalue = 0, }, 2019 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 2020 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2021 .accessfn = pmreg_access, 2022 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2023 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 2024 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 2025 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2026 .accessfn = pmreg_access, 2027 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2028 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 2029 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2030 .accessfn = pmreg_access_xevcntr, 2031 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2032 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 2033 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 2034 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2035 .accessfn = pmreg_access_xevcntr, 2036 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2037 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2038 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2039 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2040 .resetvalue = 0, 2041 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2042 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2043 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2044 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2045 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2046 .resetvalue = 0, 2047 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2048 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2049 .access = PL1_RW, .accessfn = access_tpm, 2050 .type = ARM_CP_ALIAS | ARM_CP_IO, 2051 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2052 .resetvalue = 0, 2053 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2054 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2055 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2056 .access = PL1_RW, .accessfn = access_tpm, 2057 .type = ARM_CP_IO, 2058 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2059 .writefn = pmintenset_write, .raw_writefn = raw_write, 2060 .resetvalue = 0x0 }, 2061 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2062 .access = PL1_RW, .accessfn = access_tpm, 2063 .type = ARM_CP_ALIAS | ARM_CP_IO, 2064 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2065 .writefn = pmintenclr_write, }, 2066 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2067 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2068 .access = PL1_RW, .accessfn = access_tpm, 2069 .type = ARM_CP_ALIAS | ARM_CP_IO, 2070 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2071 .writefn = pmintenclr_write }, 2072 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2073 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2074 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2075 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2076 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2077 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0, 2078 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2079 offsetof(CPUARMState, cp15.csselr_ns) } }, 2080 /* Auxiliary ID register: this actually has an IMPDEF value but for now 2081 * just RAZ for all cores: 2082 */ 2083 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2084 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2085 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 2086 /* Auxiliary fault status registers: these also are IMPDEF, and we 2087 * choose to RAZ/WI for all cores. 2088 */ 2089 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2090 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2091 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2092 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2093 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2094 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2095 /* MAIR can just read-as-written because we don't implement caches 2096 * and so don't need to care about memory attributes. 2097 */ 2098 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2099 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2100 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2101 .resetvalue = 0 }, 2102 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2103 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2104 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2105 .resetvalue = 0 }, 2106 /* For non-long-descriptor page tables these are PRRR and NMRR; 2107 * regardless they still act as reads-as-written for QEMU. 2108 */ 2109 /* MAIR0/1 are defined separately from their 64-bit counterpart which 2110 * allows them to assign the correct fieldoffset based on the endianness 2111 * handled in the field definitions. 2112 */ 2113 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2114 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW, 2115 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2116 offsetof(CPUARMState, cp15.mair0_ns) }, 2117 .resetfn = arm_cp_reset_ignore }, 2118 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2119 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW, 2120 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2121 offsetof(CPUARMState, cp15.mair1_ns) }, 2122 .resetfn = arm_cp_reset_ignore }, 2123 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2124 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2125 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2126 /* 32 bit ITLB invalidates */ 2127 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2128 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2129 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2130 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2131 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2132 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2133 /* 32 bit DTLB invalidates */ 2134 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2135 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2136 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2137 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2138 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2139 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2140 /* 32 bit TLB invalidates */ 2141 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2142 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2143 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2144 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2145 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2146 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2147 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2148 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 2149 REGINFO_SENTINEL 2150 }; 2151 2152 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2153 /* 32 bit TLB invalidates, Inner Shareable */ 2154 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2155 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write }, 2156 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2157 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 2158 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2159 .type = ARM_CP_NO_RAW, .access = PL1_W, 2160 .writefn = tlbiasid_is_write }, 2161 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2162 .type = ARM_CP_NO_RAW, .access = PL1_W, 2163 .writefn = tlbimvaa_is_write }, 2164 REGINFO_SENTINEL 2165 }; 2166 2167 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2168 /* PMOVSSET is not implemented in v7 before v7ve */ 2169 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2170 .access = PL0_RW, .accessfn = pmreg_access, 2171 .type = ARM_CP_ALIAS | ARM_CP_IO, 2172 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2173 .writefn = pmovsset_write, 2174 .raw_writefn = raw_write }, 2175 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2176 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2177 .access = PL0_RW, .accessfn = pmreg_access, 2178 .type = ARM_CP_ALIAS | ARM_CP_IO, 2179 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2180 .writefn = pmovsset_write, 2181 .raw_writefn = raw_write }, 2182 REGINFO_SENTINEL 2183 }; 2184 2185 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2186 uint64_t value) 2187 { 2188 value &= 1; 2189 env->teecr = value; 2190 } 2191 2192 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2193 bool isread) 2194 { 2195 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2196 return CP_ACCESS_TRAP; 2197 } 2198 return CP_ACCESS_OK; 2199 } 2200 2201 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2202 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2203 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2204 .resetvalue = 0, 2205 .writefn = teecr_write }, 2206 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2207 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2208 .accessfn = teehbr_access, .resetvalue = 0 }, 2209 REGINFO_SENTINEL 2210 }; 2211 2212 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2213 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2214 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2215 .access = PL0_RW, 2216 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2217 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2218 .access = PL0_RW, 2219 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2220 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2221 .resetfn = arm_cp_reset_ignore }, 2222 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2223 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2224 .access = PL0_R|PL1_W, 2225 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2226 .resetvalue = 0}, 2227 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2228 .access = PL0_R|PL1_W, 2229 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2230 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2231 .resetfn = arm_cp_reset_ignore }, 2232 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2233 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2234 .access = PL1_RW, 2235 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2236 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2237 .access = PL1_RW, 2238 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2239 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2240 .resetvalue = 0 }, 2241 REGINFO_SENTINEL 2242 }; 2243 2244 #ifndef CONFIG_USER_ONLY 2245 2246 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2247 bool isread) 2248 { 2249 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2250 * Writable only at the highest implemented exception level. 2251 */ 2252 int el = arm_current_el(env); 2253 2254 switch (el) { 2255 case 0: 2256 if (!extract32(env->cp15.c14_cntkctl, 0, 2)) { 2257 return CP_ACCESS_TRAP; 2258 } 2259 break; 2260 case 1: 2261 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2262 arm_is_secure_below_el3(env)) { 2263 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2264 return CP_ACCESS_TRAP_UNCATEGORIZED; 2265 } 2266 break; 2267 case 2: 2268 case 3: 2269 break; 2270 } 2271 2272 if (!isread && el < arm_highest_el(env)) { 2273 return CP_ACCESS_TRAP_UNCATEGORIZED; 2274 } 2275 2276 return CP_ACCESS_OK; 2277 } 2278 2279 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2280 bool isread) 2281 { 2282 unsigned int cur_el = arm_current_el(env); 2283 bool secure = arm_is_secure(env); 2284 2285 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */ 2286 if (cur_el == 0 && 2287 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2288 return CP_ACCESS_TRAP; 2289 } 2290 2291 if (arm_feature(env, ARM_FEATURE_EL2) && 2292 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2293 !extract32(env->cp15.cnthctl_el2, 0, 1)) { 2294 return CP_ACCESS_TRAP_EL2; 2295 } 2296 return CP_ACCESS_OK; 2297 } 2298 2299 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2300 bool isread) 2301 { 2302 unsigned int cur_el = arm_current_el(env); 2303 bool secure = arm_is_secure(env); 2304 2305 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if 2306 * EL0[PV]TEN is zero. 2307 */ 2308 if (cur_el == 0 && 2309 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2310 return CP_ACCESS_TRAP; 2311 } 2312 2313 if (arm_feature(env, ARM_FEATURE_EL2) && 2314 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2315 !extract32(env->cp15.cnthctl_el2, 1, 1)) { 2316 return CP_ACCESS_TRAP_EL2; 2317 } 2318 return CP_ACCESS_OK; 2319 } 2320 2321 static CPAccessResult gt_pct_access(CPUARMState *env, 2322 const ARMCPRegInfo *ri, 2323 bool isread) 2324 { 2325 return gt_counter_access(env, GTIMER_PHYS, isread); 2326 } 2327 2328 static CPAccessResult gt_vct_access(CPUARMState *env, 2329 const ARMCPRegInfo *ri, 2330 bool isread) 2331 { 2332 return gt_counter_access(env, GTIMER_VIRT, isread); 2333 } 2334 2335 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2336 bool isread) 2337 { 2338 return gt_timer_access(env, GTIMER_PHYS, isread); 2339 } 2340 2341 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2342 bool isread) 2343 { 2344 return gt_timer_access(env, GTIMER_VIRT, isread); 2345 } 2346 2347 static CPAccessResult gt_stimer_access(CPUARMState *env, 2348 const ARMCPRegInfo *ri, 2349 bool isread) 2350 { 2351 /* The AArch64 register view of the secure physical timer is 2352 * always accessible from EL3, and configurably accessible from 2353 * Secure EL1. 2354 */ 2355 switch (arm_current_el(env)) { 2356 case 1: 2357 if (!arm_is_secure(env)) { 2358 return CP_ACCESS_TRAP; 2359 } 2360 if (!(env->cp15.scr_el3 & SCR_ST)) { 2361 return CP_ACCESS_TRAP_EL3; 2362 } 2363 return CP_ACCESS_OK; 2364 case 0: 2365 case 2: 2366 return CP_ACCESS_TRAP; 2367 case 3: 2368 return CP_ACCESS_OK; 2369 default: 2370 g_assert_not_reached(); 2371 } 2372 } 2373 2374 static uint64_t gt_get_countervalue(CPUARMState *env) 2375 { 2376 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE; 2377 } 2378 2379 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2380 { 2381 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2382 2383 if (gt->ctl & 1) { 2384 /* Timer enabled: calculate and set current ISTATUS, irq, and 2385 * reset timer to when ISTATUS next has to change 2386 */ 2387 uint64_t offset = timeridx == GTIMER_VIRT ? 2388 cpu->env.cp15.cntvoff_el2 : 0; 2389 uint64_t count = gt_get_countervalue(&cpu->env); 2390 /* Note that this must be unsigned 64 bit arithmetic: */ 2391 int istatus = count - offset >= gt->cval; 2392 uint64_t nexttick; 2393 int irqstate; 2394 2395 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2396 2397 irqstate = (istatus && !(gt->ctl & 2)); 2398 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2399 2400 if (istatus) { 2401 /* Next transition is when count rolls back over to zero */ 2402 nexttick = UINT64_MAX; 2403 } else { 2404 /* Next transition is when we hit cval */ 2405 nexttick = gt->cval + offset; 2406 } 2407 /* Note that the desired next expiry time might be beyond the 2408 * signed-64-bit range of a QEMUTimer -- in this case we just 2409 * set the timer for as far in the future as possible. When the 2410 * timer expires we will reset the timer for any remaining period. 2411 */ 2412 if (nexttick > INT64_MAX / GTIMER_SCALE) { 2413 nexttick = INT64_MAX / GTIMER_SCALE; 2414 } 2415 timer_mod(cpu->gt_timer[timeridx], nexttick); 2416 trace_arm_gt_recalc(timeridx, irqstate, nexttick); 2417 } else { 2418 /* Timer disabled: ISTATUS and timer output always clear */ 2419 gt->ctl &= ~4; 2420 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0); 2421 timer_del(cpu->gt_timer[timeridx]); 2422 trace_arm_gt_recalc_disabled(timeridx); 2423 } 2424 } 2425 2426 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2427 int timeridx) 2428 { 2429 ARMCPU *cpu = arm_env_get_cpu(env); 2430 2431 timer_del(cpu->gt_timer[timeridx]); 2432 } 2433 2434 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2435 { 2436 return gt_get_countervalue(env); 2437 } 2438 2439 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2440 { 2441 return gt_get_countervalue(env) - env->cp15.cntvoff_el2; 2442 } 2443 2444 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2445 int timeridx, 2446 uint64_t value) 2447 { 2448 trace_arm_gt_cval_write(timeridx, value); 2449 env->cp15.c14_timer[timeridx].cval = value; 2450 gt_recalc_timer(arm_env_get_cpu(env), timeridx); 2451 } 2452 2453 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2454 int timeridx) 2455 { 2456 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2457 2458 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2459 (gt_get_countervalue(env) - offset)); 2460 } 2461 2462 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2463 int timeridx, 2464 uint64_t value) 2465 { 2466 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2467 2468 trace_arm_gt_tval_write(timeridx, value); 2469 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2470 sextract64(value, 0, 32); 2471 gt_recalc_timer(arm_env_get_cpu(env), timeridx); 2472 } 2473 2474 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2475 int timeridx, 2476 uint64_t value) 2477 { 2478 ARMCPU *cpu = arm_env_get_cpu(env); 2479 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2480 2481 trace_arm_gt_ctl_write(timeridx, value); 2482 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2483 if ((oldval ^ value) & 1) { 2484 /* Enable toggled */ 2485 gt_recalc_timer(cpu, timeridx); 2486 } else if ((oldval ^ value) & 2) { 2487 /* IMASK toggled: don't need to recalculate, 2488 * just set the interrupt line based on ISTATUS 2489 */ 2490 int irqstate = (oldval & 4) && !(value & 2); 2491 2492 trace_arm_gt_imask_toggle(timeridx, irqstate); 2493 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2494 } 2495 } 2496 2497 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2498 { 2499 gt_timer_reset(env, ri, GTIMER_PHYS); 2500 } 2501 2502 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2503 uint64_t value) 2504 { 2505 gt_cval_write(env, ri, GTIMER_PHYS, value); 2506 } 2507 2508 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2509 { 2510 return gt_tval_read(env, ri, GTIMER_PHYS); 2511 } 2512 2513 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2514 uint64_t value) 2515 { 2516 gt_tval_write(env, ri, GTIMER_PHYS, value); 2517 } 2518 2519 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2520 uint64_t value) 2521 { 2522 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2523 } 2524 2525 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2526 { 2527 gt_timer_reset(env, ri, GTIMER_VIRT); 2528 } 2529 2530 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2531 uint64_t value) 2532 { 2533 gt_cval_write(env, ri, GTIMER_VIRT, value); 2534 } 2535 2536 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2537 { 2538 return gt_tval_read(env, ri, GTIMER_VIRT); 2539 } 2540 2541 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2542 uint64_t value) 2543 { 2544 gt_tval_write(env, ri, GTIMER_VIRT, value); 2545 } 2546 2547 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2548 uint64_t value) 2549 { 2550 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2551 } 2552 2553 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2554 uint64_t value) 2555 { 2556 ARMCPU *cpu = arm_env_get_cpu(env); 2557 2558 trace_arm_gt_cntvoff_write(value); 2559 raw_write(env, ri, value); 2560 gt_recalc_timer(cpu, GTIMER_VIRT); 2561 } 2562 2563 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2564 { 2565 gt_timer_reset(env, ri, GTIMER_HYP); 2566 } 2567 2568 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2569 uint64_t value) 2570 { 2571 gt_cval_write(env, ri, GTIMER_HYP, value); 2572 } 2573 2574 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2575 { 2576 return gt_tval_read(env, ri, GTIMER_HYP); 2577 } 2578 2579 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2580 uint64_t value) 2581 { 2582 gt_tval_write(env, ri, GTIMER_HYP, value); 2583 } 2584 2585 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2586 uint64_t value) 2587 { 2588 gt_ctl_write(env, ri, GTIMER_HYP, value); 2589 } 2590 2591 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2592 { 2593 gt_timer_reset(env, ri, GTIMER_SEC); 2594 } 2595 2596 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2597 uint64_t value) 2598 { 2599 gt_cval_write(env, ri, GTIMER_SEC, value); 2600 } 2601 2602 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2603 { 2604 return gt_tval_read(env, ri, GTIMER_SEC); 2605 } 2606 2607 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2608 uint64_t value) 2609 { 2610 gt_tval_write(env, ri, GTIMER_SEC, value); 2611 } 2612 2613 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2614 uint64_t value) 2615 { 2616 gt_ctl_write(env, ri, GTIMER_SEC, value); 2617 } 2618 2619 void arm_gt_ptimer_cb(void *opaque) 2620 { 2621 ARMCPU *cpu = opaque; 2622 2623 gt_recalc_timer(cpu, GTIMER_PHYS); 2624 } 2625 2626 void arm_gt_vtimer_cb(void *opaque) 2627 { 2628 ARMCPU *cpu = opaque; 2629 2630 gt_recalc_timer(cpu, GTIMER_VIRT); 2631 } 2632 2633 void arm_gt_htimer_cb(void *opaque) 2634 { 2635 ARMCPU *cpu = opaque; 2636 2637 gt_recalc_timer(cpu, GTIMER_HYP); 2638 } 2639 2640 void arm_gt_stimer_cb(void *opaque) 2641 { 2642 ARMCPU *cpu = opaque; 2643 2644 gt_recalc_timer(cpu, GTIMER_SEC); 2645 } 2646 2647 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2648 /* Note that CNTFRQ is purely reads-as-written for the benefit 2649 * of software; writing it doesn't actually change the timer frequency. 2650 * Our reset value matches the fixed frequency we implement the timer at. 2651 */ 2652 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 2653 .type = ARM_CP_ALIAS, 2654 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2655 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 2656 }, 2657 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2658 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2659 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2660 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2661 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE, 2662 }, 2663 /* overall control: mostly access permissions */ 2664 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 2665 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 2666 .access = PL1_RW, 2667 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 2668 .resetvalue = 0, 2669 }, 2670 /* per-timer control */ 2671 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2672 .secure = ARM_CP_SECSTATE_NS, 2673 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2674 .accessfn = gt_ptimer_access, 2675 .fieldoffset = offsetoflow32(CPUARMState, 2676 cp15.c14_timer[GTIMER_PHYS].ctl), 2677 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2678 }, 2679 { .name = "CNTP_CTL_S", 2680 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2681 .secure = ARM_CP_SECSTATE_S, 2682 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2683 .accessfn = gt_ptimer_access, 2684 .fieldoffset = offsetoflow32(CPUARMState, 2685 cp15.c14_timer[GTIMER_SEC].ctl), 2686 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2687 }, 2688 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 2689 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 2690 .type = ARM_CP_IO, .access = PL0_RW, 2691 .accessfn = gt_ptimer_access, 2692 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 2693 .resetvalue = 0, 2694 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2695 }, 2696 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 2697 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2698 .accessfn = gt_vtimer_access, 2699 .fieldoffset = offsetoflow32(CPUARMState, 2700 cp15.c14_timer[GTIMER_VIRT].ctl), 2701 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2702 }, 2703 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 2704 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 2705 .type = ARM_CP_IO, .access = PL0_RW, 2706 .accessfn = gt_vtimer_access, 2707 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 2708 .resetvalue = 0, 2709 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2710 }, 2711 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 2712 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2713 .secure = ARM_CP_SECSTATE_NS, 2714 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2715 .accessfn = gt_ptimer_access, 2716 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2717 }, 2718 { .name = "CNTP_TVAL_S", 2719 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2720 .secure = ARM_CP_SECSTATE_S, 2721 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2722 .accessfn = gt_ptimer_access, 2723 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 2724 }, 2725 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2726 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 2727 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2728 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 2729 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2730 }, 2731 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 2732 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2733 .accessfn = gt_vtimer_access, 2734 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2735 }, 2736 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2737 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 2738 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2739 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 2740 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2741 }, 2742 /* The counter itself */ 2743 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 2744 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2745 .accessfn = gt_pct_access, 2746 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 2747 }, 2748 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 2749 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 2750 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2751 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 2752 }, 2753 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 2754 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2755 .accessfn = gt_vct_access, 2756 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 2757 }, 2758 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2759 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2760 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2761 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 2762 }, 2763 /* Comparison value, indicating when the timer goes off */ 2764 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 2765 .secure = ARM_CP_SECSTATE_NS, 2766 .access = PL0_RW, 2767 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2768 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2769 .accessfn = gt_ptimer_access, 2770 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2771 }, 2772 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 2773 .secure = ARM_CP_SECSTATE_S, 2774 .access = PL0_RW, 2775 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2776 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2777 .accessfn = gt_ptimer_access, 2778 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2779 }, 2780 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2781 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 2782 .access = PL0_RW, 2783 .type = ARM_CP_IO, 2784 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2785 .resetvalue = 0, .accessfn = gt_ptimer_access, 2786 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2787 }, 2788 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 2789 .access = PL0_RW, 2790 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2791 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2792 .accessfn = gt_vtimer_access, 2793 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2794 }, 2795 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2796 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 2797 .access = PL0_RW, 2798 .type = ARM_CP_IO, 2799 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2800 .resetvalue = 0, .accessfn = gt_vtimer_access, 2801 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2802 }, 2803 /* Secure timer -- this is actually restricted to only EL3 2804 * and configurably Secure-EL1 via the accessfn. 2805 */ 2806 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 2807 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 2808 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 2809 .accessfn = gt_stimer_access, 2810 .readfn = gt_sec_tval_read, 2811 .writefn = gt_sec_tval_write, 2812 .resetfn = gt_sec_timer_reset, 2813 }, 2814 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 2815 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 2816 .type = ARM_CP_IO, .access = PL1_RW, 2817 .accessfn = gt_stimer_access, 2818 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 2819 .resetvalue = 0, 2820 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2821 }, 2822 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 2823 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 2824 .type = ARM_CP_IO, .access = PL1_RW, 2825 .accessfn = gt_stimer_access, 2826 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2827 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2828 }, 2829 REGINFO_SENTINEL 2830 }; 2831 2832 #else 2833 2834 /* In user-mode most of the generic timer registers are inaccessible 2835 * however modern kernels (4.12+) allow access to cntvct_el0 2836 */ 2837 2838 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2839 { 2840 /* Currently we have no support for QEMUTimer in linux-user so we 2841 * can't call gt_get_countervalue(env), instead we directly 2842 * call the lower level functions. 2843 */ 2844 return cpu_get_clock() / GTIMER_SCALE; 2845 } 2846 2847 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2848 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2849 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2850 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 2851 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2852 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE, 2853 }, 2854 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2855 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2856 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2857 .readfn = gt_virt_cnt_read, 2858 }, 2859 REGINFO_SENTINEL 2860 }; 2861 2862 #endif 2863 2864 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2865 { 2866 if (arm_feature(env, ARM_FEATURE_LPAE)) { 2867 raw_write(env, ri, value); 2868 } else if (arm_feature(env, ARM_FEATURE_V7)) { 2869 raw_write(env, ri, value & 0xfffff6ff); 2870 } else { 2871 raw_write(env, ri, value & 0xfffff1ff); 2872 } 2873 } 2874 2875 #ifndef CONFIG_USER_ONLY 2876 /* get_phys_addr() isn't present for user-mode-only targets */ 2877 2878 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 2879 bool isread) 2880 { 2881 if (ri->opc2 & 4) { 2882 /* The ATS12NSO* operations must trap to EL3 if executed in 2883 * Secure EL1 (which can only happen if EL3 is AArch64). 2884 * They are simply UNDEF if executed from NS EL1. 2885 * They function normally from EL2 or EL3. 2886 */ 2887 if (arm_current_el(env) == 1) { 2888 if (arm_is_secure_below_el3(env)) { 2889 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3; 2890 } 2891 return CP_ACCESS_TRAP_UNCATEGORIZED; 2892 } 2893 } 2894 return CP_ACCESS_OK; 2895 } 2896 2897 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 2898 MMUAccessType access_type, ARMMMUIdx mmu_idx) 2899 { 2900 hwaddr phys_addr; 2901 target_ulong page_size; 2902 int prot; 2903 bool ret; 2904 uint64_t par64; 2905 bool format64 = false; 2906 MemTxAttrs attrs = {}; 2907 ARMMMUFaultInfo fi = {}; 2908 ARMCacheAttrs cacheattrs = {}; 2909 2910 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs, 2911 &prot, &page_size, &fi, &cacheattrs); 2912 2913 if (is_a64(env)) { 2914 format64 = true; 2915 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 2916 /* 2917 * ATS1Cxx: 2918 * * TTBCR.EAE determines whether the result is returned using the 2919 * 32-bit or the 64-bit PAR format 2920 * * Instructions executed in Hyp mode always use the 64bit format 2921 * 2922 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 2923 * * The Non-secure TTBCR.EAE bit is set to 1 2924 * * The implementation includes EL2, and the value of HCR.VM is 1 2925 * 2926 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 2927 * 2928 * ATS1Hx always uses the 64bit format. 2929 */ 2930 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 2931 2932 if (arm_feature(env, ARM_FEATURE_EL2)) { 2933 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 2934 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 2935 } else { 2936 format64 |= arm_current_el(env) == 2; 2937 } 2938 } 2939 } 2940 2941 if (format64) { 2942 /* Create a 64-bit PAR */ 2943 par64 = (1 << 11); /* LPAE bit always set */ 2944 if (!ret) { 2945 par64 |= phys_addr & ~0xfffULL; 2946 if (!attrs.secure) { 2947 par64 |= (1 << 9); /* NS */ 2948 } 2949 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */ 2950 par64 |= cacheattrs.shareability << 7; /* SH */ 2951 } else { 2952 uint32_t fsr = arm_fi_to_lfsc(&fi); 2953 2954 par64 |= 1; /* F */ 2955 par64 |= (fsr & 0x3f) << 1; /* FS */ 2956 if (fi.stage2) { 2957 par64 |= (1 << 9); /* S */ 2958 } 2959 if (fi.s1ptw) { 2960 par64 |= (1 << 8); /* PTW */ 2961 } 2962 } 2963 } else { 2964 /* fsr is a DFSR/IFSR value for the short descriptor 2965 * translation table format (with WnR always clear). 2966 * Convert it to a 32-bit PAR. 2967 */ 2968 if (!ret) { 2969 /* We do not set any attribute bits in the PAR */ 2970 if (page_size == (1 << 24) 2971 && arm_feature(env, ARM_FEATURE_V7)) { 2972 par64 = (phys_addr & 0xff000000) | (1 << 1); 2973 } else { 2974 par64 = phys_addr & 0xfffff000; 2975 } 2976 if (!attrs.secure) { 2977 par64 |= (1 << 9); /* NS */ 2978 } 2979 } else { 2980 uint32_t fsr = arm_fi_to_sfsc(&fi); 2981 2982 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 2983 ((fsr & 0xf) << 1) | 1; 2984 } 2985 } 2986 return par64; 2987 } 2988 2989 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2990 { 2991 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 2992 uint64_t par64; 2993 ARMMMUIdx mmu_idx; 2994 int el = arm_current_el(env); 2995 bool secure = arm_is_secure_below_el3(env); 2996 2997 switch (ri->opc2 & 6) { 2998 case 0: 2999 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */ 3000 switch (el) { 3001 case 3: 3002 mmu_idx = ARMMMUIdx_S1E3; 3003 break; 3004 case 2: 3005 mmu_idx = ARMMMUIdx_S1NSE1; 3006 break; 3007 case 1: 3008 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 3009 break; 3010 default: 3011 g_assert_not_reached(); 3012 } 3013 break; 3014 case 2: 3015 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3016 switch (el) { 3017 case 3: 3018 mmu_idx = ARMMMUIdx_S1SE0; 3019 break; 3020 case 2: 3021 mmu_idx = ARMMMUIdx_S1NSE0; 3022 break; 3023 case 1: 3024 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 3025 break; 3026 default: 3027 g_assert_not_reached(); 3028 } 3029 break; 3030 case 4: 3031 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3032 mmu_idx = ARMMMUIdx_S12NSE1; 3033 break; 3034 case 6: 3035 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3036 mmu_idx = ARMMMUIdx_S12NSE0; 3037 break; 3038 default: 3039 g_assert_not_reached(); 3040 } 3041 3042 par64 = do_ats_write(env, value, access_type, mmu_idx); 3043 3044 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3045 } 3046 3047 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3048 uint64_t value) 3049 { 3050 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3051 uint64_t par64; 3052 3053 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2); 3054 3055 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3056 } 3057 3058 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3059 bool isread) 3060 { 3061 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) { 3062 return CP_ACCESS_TRAP; 3063 } 3064 return CP_ACCESS_OK; 3065 } 3066 3067 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3068 uint64_t value) 3069 { 3070 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3071 ARMMMUIdx mmu_idx; 3072 int secure = arm_is_secure_below_el3(env); 3073 3074 switch (ri->opc2 & 6) { 3075 case 0: 3076 switch (ri->opc1) { 3077 case 0: /* AT S1E1R, AT S1E1W */ 3078 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 3079 break; 3080 case 4: /* AT S1E2R, AT S1E2W */ 3081 mmu_idx = ARMMMUIdx_S1E2; 3082 break; 3083 case 6: /* AT S1E3R, AT S1E3W */ 3084 mmu_idx = ARMMMUIdx_S1E3; 3085 break; 3086 default: 3087 g_assert_not_reached(); 3088 } 3089 break; 3090 case 2: /* AT S1E0R, AT S1E0W */ 3091 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 3092 break; 3093 case 4: /* AT S12E1R, AT S12E1W */ 3094 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1; 3095 break; 3096 case 6: /* AT S12E0R, AT S12E0W */ 3097 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0; 3098 break; 3099 default: 3100 g_assert_not_reached(); 3101 } 3102 3103 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx); 3104 } 3105 #endif 3106 3107 static const ARMCPRegInfo vapa_cp_reginfo[] = { 3108 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 3109 .access = PL1_RW, .resetvalue = 0, 3110 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 3111 offsetoflow32(CPUARMState, cp15.par_ns) }, 3112 .writefn = par_write }, 3113 #ifndef CONFIG_USER_ONLY 3114 /* This underdecoding is safe because the reginfo is NO_RAW. */ 3115 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 3116 .access = PL1_W, .accessfn = ats_access, 3117 .writefn = ats_write, .type = ARM_CP_NO_RAW }, 3118 #endif 3119 REGINFO_SENTINEL 3120 }; 3121 3122 /* Return basic MPU access permission bits. */ 3123 static uint32_t simple_mpu_ap_bits(uint32_t val) 3124 { 3125 uint32_t ret; 3126 uint32_t mask; 3127 int i; 3128 ret = 0; 3129 mask = 3; 3130 for (i = 0; i < 16; i += 2) { 3131 ret |= (val >> i) & mask; 3132 mask <<= 2; 3133 } 3134 return ret; 3135 } 3136 3137 /* Pad basic MPU access permission bits to extended format. */ 3138 static uint32_t extended_mpu_ap_bits(uint32_t val) 3139 { 3140 uint32_t ret; 3141 uint32_t mask; 3142 int i; 3143 ret = 0; 3144 mask = 3; 3145 for (i = 0; i < 16; i += 2) { 3146 ret |= (val & mask) << i; 3147 mask <<= 2; 3148 } 3149 return ret; 3150 } 3151 3152 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3153 uint64_t value) 3154 { 3155 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3156 } 3157 3158 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3159 { 3160 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3161 } 3162 3163 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3164 uint64_t value) 3165 { 3166 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3167 } 3168 3169 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3170 { 3171 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3172 } 3173 3174 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3175 { 3176 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3177 3178 if (!u32p) { 3179 return 0; 3180 } 3181 3182 u32p += env->pmsav7.rnr[M_REG_NS]; 3183 return *u32p; 3184 } 3185 3186 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3187 uint64_t value) 3188 { 3189 ARMCPU *cpu = arm_env_get_cpu(env); 3190 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3191 3192 if (!u32p) { 3193 return; 3194 } 3195 3196 u32p += env->pmsav7.rnr[M_REG_NS]; 3197 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3198 *u32p = value; 3199 } 3200 3201 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3202 uint64_t value) 3203 { 3204 ARMCPU *cpu = arm_env_get_cpu(env); 3205 uint32_t nrgs = cpu->pmsav7_dregion; 3206 3207 if (value >= nrgs) { 3208 qemu_log_mask(LOG_GUEST_ERROR, 3209 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3210 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3211 return; 3212 } 3213 3214 raw_write(env, ri, value); 3215 } 3216 3217 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 3218 /* Reset for all these registers is handled in arm_cpu_reset(), 3219 * because the PMSAv7 is also used by M-profile CPUs, which do 3220 * not register cpregs but still need the state to be reset. 3221 */ 3222 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 3223 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3224 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 3225 .readfn = pmsav7_read, .writefn = pmsav7_write, 3226 .resetfn = arm_cp_reset_ignore }, 3227 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 3228 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3229 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 3230 .readfn = pmsav7_read, .writefn = pmsav7_write, 3231 .resetfn = arm_cp_reset_ignore }, 3232 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 3233 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3234 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 3235 .readfn = pmsav7_read, .writefn = pmsav7_write, 3236 .resetfn = arm_cp_reset_ignore }, 3237 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 3238 .access = PL1_RW, 3239 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 3240 .writefn = pmsav7_rgnr_write, 3241 .resetfn = arm_cp_reset_ignore }, 3242 REGINFO_SENTINEL 3243 }; 3244 3245 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 3246 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3247 .access = PL1_RW, .type = ARM_CP_ALIAS, 3248 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3249 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 3250 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3251 .access = PL1_RW, .type = ARM_CP_ALIAS, 3252 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3253 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 3254 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 3255 .access = PL1_RW, 3256 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3257 .resetvalue = 0, }, 3258 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 3259 .access = PL1_RW, 3260 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3261 .resetvalue = 0, }, 3262 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 3263 .access = PL1_RW, 3264 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 3265 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 3266 .access = PL1_RW, 3267 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 3268 /* Protection region base and size registers */ 3269 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 3270 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3271 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 3272 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 3273 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3274 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 3275 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 3276 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3277 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 3278 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 3279 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3280 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 3281 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 3282 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3283 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 3284 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 3285 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3286 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 3287 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 3288 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3289 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 3290 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 3291 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3292 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 3293 REGINFO_SENTINEL 3294 }; 3295 3296 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 3297 uint64_t value) 3298 { 3299 TCR *tcr = raw_ptr(env, ri); 3300 int maskshift = extract32(value, 0, 3); 3301 3302 if (!arm_feature(env, ARM_FEATURE_V8)) { 3303 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 3304 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 3305 * using Long-desciptor translation table format */ 3306 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 3307 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 3308 /* In an implementation that includes the Security Extensions 3309 * TTBCR has additional fields PD0 [4] and PD1 [5] for 3310 * Short-descriptor translation table format. 3311 */ 3312 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 3313 } else { 3314 value &= TTBCR_N; 3315 } 3316 } 3317 3318 /* Update the masks corresponding to the TCR bank being written 3319 * Note that we always calculate mask and base_mask, but 3320 * they are only used for short-descriptor tables (ie if EAE is 0); 3321 * for long-descriptor tables the TCR fields are used differently 3322 * and the mask and base_mask values are meaningless. 3323 */ 3324 tcr->raw_tcr = value; 3325 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift); 3326 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift); 3327 } 3328 3329 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3330 uint64_t value) 3331 { 3332 ARMCPU *cpu = arm_env_get_cpu(env); 3333 TCR *tcr = raw_ptr(env, ri); 3334 3335 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3336 /* With LPAE the TTBCR could result in a change of ASID 3337 * via the TTBCR.A1 bit, so do a TLB flush. 3338 */ 3339 tlb_flush(CPU(cpu)); 3340 } 3341 /* Preserve the high half of TCR_EL1, set via TTBCR2. */ 3342 value = deposit64(tcr->raw_tcr, 0, 32, value); 3343 vmsa_ttbcr_raw_write(env, ri, value); 3344 } 3345 3346 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3347 { 3348 TCR *tcr = raw_ptr(env, ri); 3349 3350 /* Reset both the TCR as well as the masks corresponding to the bank of 3351 * the TCR being reset. 3352 */ 3353 tcr->raw_tcr = 0; 3354 tcr->mask = 0; 3355 tcr->base_mask = 0xffffc000u; 3356 } 3357 3358 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3359 uint64_t value) 3360 { 3361 ARMCPU *cpu = arm_env_get_cpu(env); 3362 TCR *tcr = raw_ptr(env, ri); 3363 3364 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 3365 tlb_flush(CPU(cpu)); 3366 tcr->raw_tcr = value; 3367 } 3368 3369 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3370 uint64_t value) 3371 { 3372 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 3373 if (cpreg_field_is_64bit(ri) && 3374 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 3375 ARMCPU *cpu = arm_env_get_cpu(env); 3376 tlb_flush(CPU(cpu)); 3377 } 3378 raw_write(env, ri, value); 3379 } 3380 3381 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3382 uint64_t value) 3383 { 3384 ARMCPU *cpu = arm_env_get_cpu(env); 3385 CPUState *cs = CPU(cpu); 3386 3387 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */ 3388 if (raw_read(env, ri) != value) { 3389 tlb_flush_by_mmuidx(cs, 3390 ARMMMUIdxBit_S12NSE1 | 3391 ARMMMUIdxBit_S12NSE0 | 3392 ARMMMUIdxBit_S2NS); 3393 raw_write(env, ri, value); 3394 } 3395 } 3396 3397 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 3398 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3399 .access = PL1_RW, .type = ARM_CP_ALIAS, 3400 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 3401 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 3402 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3403 .access = PL1_RW, .resetvalue = 0, 3404 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 3405 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 3406 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 3407 .access = PL1_RW, .resetvalue = 0, 3408 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 3409 offsetof(CPUARMState, cp15.dfar_ns) } }, 3410 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 3411 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 3412 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 3413 .resetvalue = 0, }, 3414 REGINFO_SENTINEL 3415 }; 3416 3417 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 3418 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 3419 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 3420 .access = PL1_RW, 3421 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 3422 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 3423 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 3424 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3425 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3426 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 3427 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 3428 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 3429 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3430 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3431 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 3432 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 3433 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3434 .access = PL1_RW, .writefn = vmsa_tcr_el1_write, 3435 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write, 3436 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 3437 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3438 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 3439 .raw_writefn = vmsa_ttbcr_raw_write, 3440 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 3441 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 3442 REGINFO_SENTINEL 3443 }; 3444 3445 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing 3446 * qemu tlbs nor adjusting cached masks. 3447 */ 3448 static const ARMCPRegInfo ttbcr2_reginfo = { 3449 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 3450 .access = PL1_RW, .type = ARM_CP_ALIAS, 3451 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 3452 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) }, 3453 }; 3454 3455 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 3456 uint64_t value) 3457 { 3458 env->cp15.c15_ticonfig = value & 0xe7; 3459 /* The OS_TYPE bit in this register changes the reported CPUID! */ 3460 env->cp15.c0_cpuid = (value & (1 << 5)) ? 3461 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 3462 } 3463 3464 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 3465 uint64_t value) 3466 { 3467 env->cp15.c15_threadid = value & 0xffff; 3468 } 3469 3470 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 3471 uint64_t value) 3472 { 3473 /* Wait-for-interrupt (deprecated) */ 3474 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT); 3475 } 3476 3477 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 3478 uint64_t value) 3479 { 3480 /* On OMAP there are registers indicating the max/min index of dcache lines 3481 * containing a dirty line; cache flush operations have to reset these. 3482 */ 3483 env->cp15.c15_i_max = 0x000; 3484 env->cp15.c15_i_min = 0xff0; 3485 } 3486 3487 static const ARMCPRegInfo omap_cp_reginfo[] = { 3488 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 3489 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 3490 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 3491 .resetvalue = 0, }, 3492 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 3493 .access = PL1_RW, .type = ARM_CP_NOP }, 3494 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 3495 .access = PL1_RW, 3496 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 3497 .writefn = omap_ticonfig_write }, 3498 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 3499 .access = PL1_RW, 3500 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 3501 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 3502 .access = PL1_RW, .resetvalue = 0xff0, 3503 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 3504 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 3505 .access = PL1_RW, 3506 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 3507 .writefn = omap_threadid_write }, 3508 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 3509 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3510 .type = ARM_CP_NO_RAW, 3511 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 3512 /* TODO: Peripheral port remap register: 3513 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 3514 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 3515 * when MMU is off. 3516 */ 3517 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 3518 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 3519 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 3520 .writefn = omap_cachemaint_write }, 3521 { .name = "C9", .cp = 15, .crn = 9, 3522 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 3523 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 3524 REGINFO_SENTINEL 3525 }; 3526 3527 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3528 uint64_t value) 3529 { 3530 env->cp15.c15_cpar = value & 0x3fff; 3531 } 3532 3533 static const ARMCPRegInfo xscale_cp_reginfo[] = { 3534 { .name = "XSCALE_CPAR", 3535 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3536 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 3537 .writefn = xscale_cpar_write, }, 3538 { .name = "XSCALE_AUXCR", 3539 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 3540 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 3541 .resetvalue = 0, }, 3542 /* XScale specific cache-lockdown: since we have no cache we NOP these 3543 * and hope the guest does not really rely on cache behaviour. 3544 */ 3545 { .name = "XSCALE_LOCK_ICACHE_LINE", 3546 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 3547 .access = PL1_W, .type = ARM_CP_NOP }, 3548 { .name = "XSCALE_UNLOCK_ICACHE", 3549 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 3550 .access = PL1_W, .type = ARM_CP_NOP }, 3551 { .name = "XSCALE_DCACHE_LOCK", 3552 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 3553 .access = PL1_RW, .type = ARM_CP_NOP }, 3554 { .name = "XSCALE_UNLOCK_DCACHE", 3555 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 3556 .access = PL1_W, .type = ARM_CP_NOP }, 3557 REGINFO_SENTINEL 3558 }; 3559 3560 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 3561 /* RAZ/WI the whole crn=15 space, when we don't have a more specific 3562 * implementation of this implementation-defined space. 3563 * Ideally this should eventually disappear in favour of actually 3564 * implementing the correct behaviour for all cores. 3565 */ 3566 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 3567 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3568 .access = PL1_RW, 3569 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 3570 .resetvalue = 0 }, 3571 REGINFO_SENTINEL 3572 }; 3573 3574 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 3575 /* Cache status: RAZ because we have no cache so it's always clean */ 3576 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 3577 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3578 .resetvalue = 0 }, 3579 REGINFO_SENTINEL 3580 }; 3581 3582 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 3583 /* We never have a a block transfer operation in progress */ 3584 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 3585 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3586 .resetvalue = 0 }, 3587 /* The cache ops themselves: these all NOP for QEMU */ 3588 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 3589 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3590 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 3591 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3592 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 3593 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3594 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 3595 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3596 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 3597 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3598 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 3599 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3600 REGINFO_SENTINEL 3601 }; 3602 3603 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 3604 /* The cache test-and-clean instructions always return (1 << 30) 3605 * to indicate that there are no dirty cache lines. 3606 */ 3607 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 3608 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3609 .resetvalue = (1 << 30) }, 3610 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 3611 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3612 .resetvalue = (1 << 30) }, 3613 REGINFO_SENTINEL 3614 }; 3615 3616 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 3617 /* Ignore ReadBuffer accesses */ 3618 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 3619 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3620 .access = PL1_RW, .resetvalue = 0, 3621 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 3622 REGINFO_SENTINEL 3623 }; 3624 3625 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3626 { 3627 ARMCPU *cpu = arm_env_get_cpu(env); 3628 unsigned int cur_el = arm_current_el(env); 3629 bool secure = arm_is_secure(env); 3630 3631 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3632 return env->cp15.vpidr_el2; 3633 } 3634 return raw_read(env, ri); 3635 } 3636 3637 static uint64_t mpidr_read_val(CPUARMState *env) 3638 { 3639 ARMCPU *cpu = ARM_CPU(arm_env_get_cpu(env)); 3640 uint64_t mpidr = cpu->mp_affinity; 3641 3642 if (arm_feature(env, ARM_FEATURE_V7MP)) { 3643 mpidr |= (1U << 31); 3644 /* Cores which are uniprocessor (non-coherent) 3645 * but still implement the MP extensions set 3646 * bit 30. (For instance, Cortex-R5). 3647 */ 3648 if (cpu->mp_is_up) { 3649 mpidr |= (1u << 30); 3650 } 3651 } 3652 return mpidr; 3653 } 3654 3655 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3656 { 3657 unsigned int cur_el = arm_current_el(env); 3658 bool secure = arm_is_secure(env); 3659 3660 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3661 return env->cp15.vmpidr_el2; 3662 } 3663 return mpidr_read_val(env); 3664 } 3665 3666 static const ARMCPRegInfo lpae_cp_reginfo[] = { 3667 /* NOP AMAIR0/1 */ 3668 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 3669 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 3670 .access = PL1_RW, .type = ARM_CP_CONST, 3671 .resetvalue = 0 }, 3672 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 3673 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 3674 .access = PL1_RW, .type = ARM_CP_CONST, 3675 .resetvalue = 0 }, 3676 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 3677 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 3678 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 3679 offsetof(CPUARMState, cp15.par_ns)} }, 3680 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 3681 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3682 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3683 offsetof(CPUARMState, cp15.ttbr0_ns) }, 3684 .writefn = vmsa_ttbr_write, }, 3685 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 3686 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3687 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3688 offsetof(CPUARMState, cp15.ttbr1_ns) }, 3689 .writefn = vmsa_ttbr_write, }, 3690 REGINFO_SENTINEL 3691 }; 3692 3693 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3694 { 3695 return vfp_get_fpcr(env); 3696 } 3697 3698 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3699 uint64_t value) 3700 { 3701 vfp_set_fpcr(env, value); 3702 } 3703 3704 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3705 { 3706 return vfp_get_fpsr(env); 3707 } 3708 3709 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3710 uint64_t value) 3711 { 3712 vfp_set_fpsr(env, value); 3713 } 3714 3715 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 3716 bool isread) 3717 { 3718 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) { 3719 return CP_ACCESS_TRAP; 3720 } 3721 return CP_ACCESS_OK; 3722 } 3723 3724 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 3725 uint64_t value) 3726 { 3727 env->daif = value & PSTATE_DAIF; 3728 } 3729 3730 static CPAccessResult aa64_cacheop_access(CPUARMState *env, 3731 const ARMCPRegInfo *ri, 3732 bool isread) 3733 { 3734 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless 3735 * SCTLR_EL1.UCI is set. 3736 */ 3737 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) { 3738 return CP_ACCESS_TRAP; 3739 } 3740 return CP_ACCESS_OK; 3741 } 3742 3743 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 3744 * Page D4-1736 (DDI0487A.b) 3745 */ 3746 3747 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3748 uint64_t value) 3749 { 3750 CPUState *cs = ENV_GET_CPU(env); 3751 bool sec = arm_is_secure_below_el3(env); 3752 3753 if (sec) { 3754 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3755 ARMMMUIdxBit_S1SE1 | 3756 ARMMMUIdxBit_S1SE0); 3757 } else { 3758 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3759 ARMMMUIdxBit_S12NSE1 | 3760 ARMMMUIdxBit_S12NSE0); 3761 } 3762 } 3763 3764 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3765 uint64_t value) 3766 { 3767 CPUState *cs = ENV_GET_CPU(env); 3768 3769 if (tlb_force_broadcast(env)) { 3770 tlbi_aa64_vmalle1is_write(env, NULL, value); 3771 return; 3772 } 3773 3774 if (arm_is_secure_below_el3(env)) { 3775 tlb_flush_by_mmuidx(cs, 3776 ARMMMUIdxBit_S1SE1 | 3777 ARMMMUIdxBit_S1SE0); 3778 } else { 3779 tlb_flush_by_mmuidx(cs, 3780 ARMMMUIdxBit_S12NSE1 | 3781 ARMMMUIdxBit_S12NSE0); 3782 } 3783 } 3784 3785 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3786 uint64_t value) 3787 { 3788 /* Note that the 'ALL' scope must invalidate both stage 1 and 3789 * stage 2 translations, whereas most other scopes only invalidate 3790 * stage 1 translations. 3791 */ 3792 ARMCPU *cpu = arm_env_get_cpu(env); 3793 CPUState *cs = CPU(cpu); 3794 3795 if (arm_is_secure_below_el3(env)) { 3796 tlb_flush_by_mmuidx(cs, 3797 ARMMMUIdxBit_S1SE1 | 3798 ARMMMUIdxBit_S1SE0); 3799 } else { 3800 if (arm_feature(env, ARM_FEATURE_EL2)) { 3801 tlb_flush_by_mmuidx(cs, 3802 ARMMMUIdxBit_S12NSE1 | 3803 ARMMMUIdxBit_S12NSE0 | 3804 ARMMMUIdxBit_S2NS); 3805 } else { 3806 tlb_flush_by_mmuidx(cs, 3807 ARMMMUIdxBit_S12NSE1 | 3808 ARMMMUIdxBit_S12NSE0); 3809 } 3810 } 3811 } 3812 3813 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3814 uint64_t value) 3815 { 3816 ARMCPU *cpu = arm_env_get_cpu(env); 3817 CPUState *cs = CPU(cpu); 3818 3819 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 3820 } 3821 3822 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3823 uint64_t value) 3824 { 3825 ARMCPU *cpu = arm_env_get_cpu(env); 3826 CPUState *cs = CPU(cpu); 3827 3828 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3); 3829 } 3830 3831 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3832 uint64_t value) 3833 { 3834 /* Note that the 'ALL' scope must invalidate both stage 1 and 3835 * stage 2 translations, whereas most other scopes only invalidate 3836 * stage 1 translations. 3837 */ 3838 CPUState *cs = ENV_GET_CPU(env); 3839 bool sec = arm_is_secure_below_el3(env); 3840 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2); 3841 3842 if (sec) { 3843 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3844 ARMMMUIdxBit_S1SE1 | 3845 ARMMMUIdxBit_S1SE0); 3846 } else if (has_el2) { 3847 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3848 ARMMMUIdxBit_S12NSE1 | 3849 ARMMMUIdxBit_S12NSE0 | 3850 ARMMMUIdxBit_S2NS); 3851 } else { 3852 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3853 ARMMMUIdxBit_S12NSE1 | 3854 ARMMMUIdxBit_S12NSE0); 3855 } 3856 } 3857 3858 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3859 uint64_t value) 3860 { 3861 CPUState *cs = ENV_GET_CPU(env); 3862 3863 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 3864 } 3865 3866 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3867 uint64_t value) 3868 { 3869 CPUState *cs = ENV_GET_CPU(env); 3870 3871 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3); 3872 } 3873 3874 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3875 uint64_t value) 3876 { 3877 /* Invalidate by VA, EL2 3878 * Currently handles both VAE2 and VALE2, since we don't support 3879 * flush-last-level-only. 3880 */ 3881 ARMCPU *cpu = arm_env_get_cpu(env); 3882 CPUState *cs = CPU(cpu); 3883 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3884 3885 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 3886 } 3887 3888 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3889 uint64_t value) 3890 { 3891 /* Invalidate by VA, EL3 3892 * Currently handles both VAE3 and VALE3, since we don't support 3893 * flush-last-level-only. 3894 */ 3895 ARMCPU *cpu = arm_env_get_cpu(env); 3896 CPUState *cs = CPU(cpu); 3897 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3898 3899 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3); 3900 } 3901 3902 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3903 uint64_t value) 3904 { 3905 ARMCPU *cpu = arm_env_get_cpu(env); 3906 CPUState *cs = CPU(cpu); 3907 bool sec = arm_is_secure_below_el3(env); 3908 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3909 3910 if (sec) { 3911 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3912 ARMMMUIdxBit_S1SE1 | 3913 ARMMMUIdxBit_S1SE0); 3914 } else { 3915 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3916 ARMMMUIdxBit_S12NSE1 | 3917 ARMMMUIdxBit_S12NSE0); 3918 } 3919 } 3920 3921 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3922 uint64_t value) 3923 { 3924 /* Invalidate by VA, EL1&0 (AArch64 version). 3925 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 3926 * since we don't support flush-for-specific-ASID-only or 3927 * flush-last-level-only. 3928 */ 3929 ARMCPU *cpu = arm_env_get_cpu(env); 3930 CPUState *cs = CPU(cpu); 3931 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3932 3933 if (tlb_force_broadcast(env)) { 3934 tlbi_aa64_vae1is_write(env, NULL, value); 3935 return; 3936 } 3937 3938 if (arm_is_secure_below_el3(env)) { 3939 tlb_flush_page_by_mmuidx(cs, pageaddr, 3940 ARMMMUIdxBit_S1SE1 | 3941 ARMMMUIdxBit_S1SE0); 3942 } else { 3943 tlb_flush_page_by_mmuidx(cs, pageaddr, 3944 ARMMMUIdxBit_S12NSE1 | 3945 ARMMMUIdxBit_S12NSE0); 3946 } 3947 } 3948 3949 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3950 uint64_t value) 3951 { 3952 CPUState *cs = ENV_GET_CPU(env); 3953 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3954 3955 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3956 ARMMMUIdxBit_S1E2); 3957 } 3958 3959 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3960 uint64_t value) 3961 { 3962 CPUState *cs = ENV_GET_CPU(env); 3963 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3964 3965 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3966 ARMMMUIdxBit_S1E3); 3967 } 3968 3969 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3970 uint64_t value) 3971 { 3972 /* Invalidate by IPA. This has to invalidate any structures that 3973 * contain only stage 2 translation information, but does not need 3974 * to apply to structures that contain combined stage 1 and stage 2 3975 * translation information. 3976 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 3977 */ 3978 ARMCPU *cpu = arm_env_get_cpu(env); 3979 CPUState *cs = CPU(cpu); 3980 uint64_t pageaddr; 3981 3982 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 3983 return; 3984 } 3985 3986 pageaddr = sextract64(value << 12, 0, 48); 3987 3988 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 3989 } 3990 3991 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3992 uint64_t value) 3993 { 3994 CPUState *cs = ENV_GET_CPU(env); 3995 uint64_t pageaddr; 3996 3997 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 3998 return; 3999 } 4000 4001 pageaddr = sextract64(value << 12, 0, 48); 4002 4003 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4004 ARMMMUIdxBit_S2NS); 4005 } 4006 4007 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 4008 bool isread) 4009 { 4010 /* We don't implement EL2, so the only control on DC ZVA is the 4011 * bit in the SCTLR which can prohibit access for EL0. 4012 */ 4013 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 4014 return CP_ACCESS_TRAP; 4015 } 4016 return CP_ACCESS_OK; 4017 } 4018 4019 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 4020 { 4021 ARMCPU *cpu = arm_env_get_cpu(env); 4022 int dzp_bit = 1 << 4; 4023 4024 /* DZP indicates whether DC ZVA access is allowed */ 4025 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 4026 dzp_bit = 0; 4027 } 4028 return cpu->dcz_blocksize | dzp_bit; 4029 } 4030 4031 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 4032 bool isread) 4033 { 4034 if (!(env->pstate & PSTATE_SP)) { 4035 /* Access to SP_EL0 is undefined if it's being used as 4036 * the stack pointer. 4037 */ 4038 return CP_ACCESS_TRAP_UNCATEGORIZED; 4039 } 4040 return CP_ACCESS_OK; 4041 } 4042 4043 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 4044 { 4045 return env->pstate & PSTATE_SP; 4046 } 4047 4048 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 4049 { 4050 update_spsel(env, val); 4051 } 4052 4053 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4054 uint64_t value) 4055 { 4056 ARMCPU *cpu = arm_env_get_cpu(env); 4057 4058 if (raw_read(env, ri) == value) { 4059 /* Skip the TLB flush if nothing actually changed; Linux likes 4060 * to do a lot of pointless SCTLR writes. 4061 */ 4062 return; 4063 } 4064 4065 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 4066 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 4067 value &= ~SCTLR_M; 4068 } 4069 4070 raw_write(env, ri, value); 4071 /* ??? Lots of these bits are not implemented. */ 4072 /* This may enable/disable the MMU, so do a TLB flush. */ 4073 tlb_flush(CPU(cpu)); 4074 } 4075 4076 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri, 4077 bool isread) 4078 { 4079 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) { 4080 return CP_ACCESS_TRAP_FP_EL2; 4081 } 4082 if (env->cp15.cptr_el[3] & CPTR_TFP) { 4083 return CP_ACCESS_TRAP_FP_EL3; 4084 } 4085 return CP_ACCESS_OK; 4086 } 4087 4088 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4089 uint64_t value) 4090 { 4091 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK; 4092 } 4093 4094 static const ARMCPRegInfo v8_cp_reginfo[] = { 4095 /* Minimal set of EL0-visible registers. This will need to be expanded 4096 * significantly for system emulation of AArch64 CPUs. 4097 */ 4098 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 4099 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 4100 .access = PL0_RW, .type = ARM_CP_NZCV }, 4101 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 4102 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 4103 .type = ARM_CP_NO_RAW, 4104 .access = PL0_RW, .accessfn = aa64_daif_access, 4105 .fieldoffset = offsetof(CPUARMState, daif), 4106 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 4107 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 4108 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 4109 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4110 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 4111 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 4112 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 4113 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4114 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 4115 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 4116 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 4117 .access = PL0_R, .type = ARM_CP_NO_RAW, 4118 .readfn = aa64_dczid_read }, 4119 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 4120 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 4121 .access = PL0_W, .type = ARM_CP_DC_ZVA, 4122 #ifndef CONFIG_USER_ONLY 4123 /* Avoid overhead of an access check that always passes in user-mode */ 4124 .accessfn = aa64_zva_access, 4125 #endif 4126 }, 4127 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 4128 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 4129 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 4130 /* Cache ops: all NOPs since we don't emulate caches */ 4131 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 4132 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4133 .access = PL1_W, .type = ARM_CP_NOP }, 4134 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 4135 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4136 .access = PL1_W, .type = ARM_CP_NOP }, 4137 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 4138 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 4139 .access = PL0_W, .type = ARM_CP_NOP, 4140 .accessfn = aa64_cacheop_access }, 4141 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 4142 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4143 .access = PL1_W, .type = ARM_CP_NOP }, 4144 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 4145 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4146 .access = PL1_W, .type = ARM_CP_NOP }, 4147 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 4148 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 4149 .access = PL0_W, .type = ARM_CP_NOP, 4150 .accessfn = aa64_cacheop_access }, 4151 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 4152 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4153 .access = PL1_W, .type = ARM_CP_NOP }, 4154 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 4155 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 4156 .access = PL0_W, .type = ARM_CP_NOP, 4157 .accessfn = aa64_cacheop_access }, 4158 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 4159 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 4160 .access = PL0_W, .type = ARM_CP_NOP, 4161 .accessfn = aa64_cacheop_access }, 4162 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 4163 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4164 .access = PL1_W, .type = ARM_CP_NOP }, 4165 /* TLBI operations */ 4166 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 4167 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 4168 .access = PL1_W, .type = ARM_CP_NO_RAW, 4169 .writefn = tlbi_aa64_vmalle1is_write }, 4170 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 4171 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 4172 .access = PL1_W, .type = ARM_CP_NO_RAW, 4173 .writefn = tlbi_aa64_vae1is_write }, 4174 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 4175 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 4176 .access = PL1_W, .type = ARM_CP_NO_RAW, 4177 .writefn = tlbi_aa64_vmalle1is_write }, 4178 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 4179 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 4180 .access = PL1_W, .type = ARM_CP_NO_RAW, 4181 .writefn = tlbi_aa64_vae1is_write }, 4182 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 4183 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4184 .access = PL1_W, .type = ARM_CP_NO_RAW, 4185 .writefn = tlbi_aa64_vae1is_write }, 4186 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 4187 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4188 .access = PL1_W, .type = ARM_CP_NO_RAW, 4189 .writefn = tlbi_aa64_vae1is_write }, 4190 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 4191 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 4192 .access = PL1_W, .type = ARM_CP_NO_RAW, 4193 .writefn = tlbi_aa64_vmalle1_write }, 4194 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 4195 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 4196 .access = PL1_W, .type = ARM_CP_NO_RAW, 4197 .writefn = tlbi_aa64_vae1_write }, 4198 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 4199 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 4200 .access = PL1_W, .type = ARM_CP_NO_RAW, 4201 .writefn = tlbi_aa64_vmalle1_write }, 4202 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 4203 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 4204 .access = PL1_W, .type = ARM_CP_NO_RAW, 4205 .writefn = tlbi_aa64_vae1_write }, 4206 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 4207 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4208 .access = PL1_W, .type = ARM_CP_NO_RAW, 4209 .writefn = tlbi_aa64_vae1_write }, 4210 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 4211 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4212 .access = PL1_W, .type = ARM_CP_NO_RAW, 4213 .writefn = tlbi_aa64_vae1_write }, 4214 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 4215 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4216 .access = PL2_W, .type = ARM_CP_NO_RAW, 4217 .writefn = tlbi_aa64_ipas2e1is_write }, 4218 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 4219 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4220 .access = PL2_W, .type = ARM_CP_NO_RAW, 4221 .writefn = tlbi_aa64_ipas2e1is_write }, 4222 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 4223 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4224 .access = PL2_W, .type = ARM_CP_NO_RAW, 4225 .writefn = tlbi_aa64_alle1is_write }, 4226 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 4227 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 4228 .access = PL2_W, .type = ARM_CP_NO_RAW, 4229 .writefn = tlbi_aa64_alle1is_write }, 4230 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 4231 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4232 .access = PL2_W, .type = ARM_CP_NO_RAW, 4233 .writefn = tlbi_aa64_ipas2e1_write }, 4234 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 4235 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4236 .access = PL2_W, .type = ARM_CP_NO_RAW, 4237 .writefn = tlbi_aa64_ipas2e1_write }, 4238 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 4239 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4240 .access = PL2_W, .type = ARM_CP_NO_RAW, 4241 .writefn = tlbi_aa64_alle1_write }, 4242 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 4243 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 4244 .access = PL2_W, .type = ARM_CP_NO_RAW, 4245 .writefn = tlbi_aa64_alle1is_write }, 4246 #ifndef CONFIG_USER_ONLY 4247 /* 64 bit address translation operations */ 4248 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 4249 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 4250 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4251 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 4252 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 4253 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4254 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 4255 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 4256 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4257 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 4258 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 4259 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4260 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 4261 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 4262 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4263 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 4264 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 4265 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4266 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 4267 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 4268 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4269 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 4270 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 4271 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4272 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 4273 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 4274 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 4275 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4276 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 4277 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 4278 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4279 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 4280 .type = ARM_CP_ALIAS, 4281 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 4282 .access = PL1_RW, .resetvalue = 0, 4283 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 4284 .writefn = par_write }, 4285 #endif 4286 /* TLB invalidate last level of translation table walk */ 4287 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4288 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 4289 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4290 .type = ARM_CP_NO_RAW, .access = PL1_W, 4291 .writefn = tlbimvaa_is_write }, 4292 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4293 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 4294 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4295 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 4296 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4297 .type = ARM_CP_NO_RAW, .access = PL2_W, 4298 .writefn = tlbimva_hyp_write }, 4299 { .name = "TLBIMVALHIS", 4300 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4301 .type = ARM_CP_NO_RAW, .access = PL2_W, 4302 .writefn = tlbimva_hyp_is_write }, 4303 { .name = "TLBIIPAS2", 4304 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4305 .type = ARM_CP_NO_RAW, .access = PL2_W, 4306 .writefn = tlbiipas2_write }, 4307 { .name = "TLBIIPAS2IS", 4308 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4309 .type = ARM_CP_NO_RAW, .access = PL2_W, 4310 .writefn = tlbiipas2_is_write }, 4311 { .name = "TLBIIPAS2L", 4312 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4313 .type = ARM_CP_NO_RAW, .access = PL2_W, 4314 .writefn = tlbiipas2_write }, 4315 { .name = "TLBIIPAS2LIS", 4316 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4317 .type = ARM_CP_NO_RAW, .access = PL2_W, 4318 .writefn = tlbiipas2_is_write }, 4319 /* 32 bit cache operations */ 4320 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4321 .type = ARM_CP_NOP, .access = PL1_W }, 4322 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 4323 .type = ARM_CP_NOP, .access = PL1_W }, 4324 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4325 .type = ARM_CP_NOP, .access = PL1_W }, 4326 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 4327 .type = ARM_CP_NOP, .access = PL1_W }, 4328 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 4329 .type = ARM_CP_NOP, .access = PL1_W }, 4330 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 4331 .type = ARM_CP_NOP, .access = PL1_W }, 4332 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4333 .type = ARM_CP_NOP, .access = PL1_W }, 4334 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4335 .type = ARM_CP_NOP, .access = PL1_W }, 4336 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 4337 .type = ARM_CP_NOP, .access = PL1_W }, 4338 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4339 .type = ARM_CP_NOP, .access = PL1_W }, 4340 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 4341 .type = ARM_CP_NOP, .access = PL1_W }, 4342 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 4343 .type = ARM_CP_NOP, .access = PL1_W }, 4344 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4345 .type = ARM_CP_NOP, .access = PL1_W }, 4346 /* MMU Domain access control / MPU write buffer control */ 4347 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 4348 .access = PL1_RW, .resetvalue = 0, 4349 .writefn = dacr_write, .raw_writefn = raw_write, 4350 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 4351 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 4352 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 4353 .type = ARM_CP_ALIAS, 4354 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 4355 .access = PL1_RW, 4356 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 4357 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 4358 .type = ARM_CP_ALIAS, 4359 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 4360 .access = PL1_RW, 4361 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 4362 /* We rely on the access checks not allowing the guest to write to the 4363 * state field when SPSel indicates that it's being used as the stack 4364 * pointer. 4365 */ 4366 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 4367 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 4368 .access = PL1_RW, .accessfn = sp_el0_access, 4369 .type = ARM_CP_ALIAS, 4370 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 4371 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 4372 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 4373 .access = PL2_RW, .type = ARM_CP_ALIAS, 4374 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 4375 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 4376 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 4377 .type = ARM_CP_NO_RAW, 4378 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 4379 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 4380 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 4381 .type = ARM_CP_ALIAS, 4382 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]), 4383 .access = PL2_RW, .accessfn = fpexc32_access }, 4384 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 4385 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 4386 .access = PL2_RW, .resetvalue = 0, 4387 .writefn = dacr_write, .raw_writefn = raw_write, 4388 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 4389 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 4390 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 4391 .access = PL2_RW, .resetvalue = 0, 4392 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 4393 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 4394 .type = ARM_CP_ALIAS, 4395 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 4396 .access = PL2_RW, 4397 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 4398 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 4399 .type = ARM_CP_ALIAS, 4400 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 4401 .access = PL2_RW, 4402 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 4403 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 4404 .type = ARM_CP_ALIAS, 4405 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 4406 .access = PL2_RW, 4407 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 4408 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 4409 .type = ARM_CP_ALIAS, 4410 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 4411 .access = PL2_RW, 4412 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 4413 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 4414 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 4415 .resetvalue = 0, 4416 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 4417 { .name = "SDCR", .type = ARM_CP_ALIAS, 4418 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 4419 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4420 .writefn = sdcr_write, 4421 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 4422 REGINFO_SENTINEL 4423 }; 4424 4425 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */ 4426 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = { 4427 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4428 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4429 .access = PL2_RW, 4430 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore }, 4431 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH, 4432 .type = ARM_CP_NO_RAW, 4433 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4434 .access = PL2_RW, 4435 .type = ARM_CP_CONST, .resetvalue = 0 }, 4436 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 4437 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 4438 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4439 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4440 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4441 .access = PL2_RW, 4442 .type = ARM_CP_CONST, .resetvalue = 0 }, 4443 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4444 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4445 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4446 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4447 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4448 .access = PL2_RW, .type = ARM_CP_CONST, 4449 .resetvalue = 0 }, 4450 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4451 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4452 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4453 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4454 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4455 .access = PL2_RW, .type = ARM_CP_CONST, 4456 .resetvalue = 0 }, 4457 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4458 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4459 .access = PL2_RW, .type = ARM_CP_CONST, 4460 .resetvalue = 0 }, 4461 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4462 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4463 .access = PL2_RW, .type = ARM_CP_CONST, 4464 .resetvalue = 0 }, 4465 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4466 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4467 .access = PL2_RW, .type = ARM_CP_CONST, 4468 .resetvalue = 0 }, 4469 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4470 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4471 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4472 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH, 4473 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4474 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4475 .type = ARM_CP_CONST, .resetvalue = 0 }, 4476 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4477 .cp = 15, .opc1 = 6, .crm = 2, 4478 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4479 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 }, 4480 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4481 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4482 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4483 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4484 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4485 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4486 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4487 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4488 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4489 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4490 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4491 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4492 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4493 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4494 .resetvalue = 0 }, 4495 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4496 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4497 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4498 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4499 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4500 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4501 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4502 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4503 .resetvalue = 0 }, 4504 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4505 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4506 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4507 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4508 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4509 .resetvalue = 0 }, 4510 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4511 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4512 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4513 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4514 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4515 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4516 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4517 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4518 .access = PL2_RW, .accessfn = access_tda, 4519 .type = ARM_CP_CONST, .resetvalue = 0 }, 4520 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH, 4521 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4522 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4523 .type = ARM_CP_CONST, .resetvalue = 0 }, 4524 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4525 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4526 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4527 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4528 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4529 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4530 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4531 .type = ARM_CP_CONST, 4532 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4533 .access = PL2_RW, .resetvalue = 0 }, 4534 REGINFO_SENTINEL 4535 }; 4536 4537 /* Ditto, but for registers which exist in ARMv8 but not v7 */ 4538 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = { 4539 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4540 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4541 .access = PL2_RW, 4542 .type = ARM_CP_CONST, .resetvalue = 0 }, 4543 REGINFO_SENTINEL 4544 }; 4545 4546 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 4547 { 4548 ARMCPU *cpu = arm_env_get_cpu(env); 4549 uint64_t valid_mask = HCR_MASK; 4550 4551 if (arm_feature(env, ARM_FEATURE_EL3)) { 4552 valid_mask &= ~HCR_HCD; 4553 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 4554 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented. 4555 * However, if we're using the SMC PSCI conduit then QEMU is 4556 * effectively acting like EL3 firmware and so the guest at 4557 * EL2 should retain the ability to prevent EL1 from being 4558 * able to make SMC calls into the ersatz firmware, so in 4559 * that case HCR.TSC should be read/write. 4560 */ 4561 valid_mask &= ~HCR_TSC; 4562 } 4563 if (cpu_isar_feature(aa64_lor, cpu)) { 4564 valid_mask |= HCR_TLOR; 4565 } 4566 if (cpu_isar_feature(aa64_pauth, cpu)) { 4567 valid_mask |= HCR_API | HCR_APK; 4568 } 4569 4570 /* Clear RES0 bits. */ 4571 value &= valid_mask; 4572 4573 /* These bits change the MMU setup: 4574 * HCR_VM enables stage 2 translation 4575 * HCR_PTW forbids certain page-table setups 4576 * HCR_DC Disables stage1 and enables stage2 translation 4577 */ 4578 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) { 4579 tlb_flush(CPU(cpu)); 4580 } 4581 env->cp15.hcr_el2 = value; 4582 4583 /* 4584 * Updates to VI and VF require us to update the status of 4585 * virtual interrupts, which are the logical OR of these bits 4586 * and the state of the input lines from the GIC. (This requires 4587 * that we have the iothread lock, which is done by marking the 4588 * reginfo structs as ARM_CP_IO.) 4589 * Note that if a write to HCR pends a VIRQ or VFIQ it is never 4590 * possible for it to be taken immediately, because VIRQ and 4591 * VFIQ are masked unless running at EL0 or EL1, and HCR 4592 * can only be written at EL2. 4593 */ 4594 g_assert(qemu_mutex_iothread_locked()); 4595 arm_cpu_update_virq(cpu); 4596 arm_cpu_update_vfiq(cpu); 4597 } 4598 4599 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 4600 uint64_t value) 4601 { 4602 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 4603 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 4604 hcr_write(env, NULL, value); 4605 } 4606 4607 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 4608 uint64_t value) 4609 { 4610 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 4611 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 4612 hcr_write(env, NULL, value); 4613 } 4614 4615 /* 4616 * Return the effective value of HCR_EL2. 4617 * Bits that are not included here: 4618 * RW (read from SCR_EL3.RW as needed) 4619 */ 4620 uint64_t arm_hcr_el2_eff(CPUARMState *env) 4621 { 4622 uint64_t ret = env->cp15.hcr_el2; 4623 4624 if (arm_is_secure_below_el3(env)) { 4625 /* 4626 * "This register has no effect if EL2 is not enabled in the 4627 * current Security state". This is ARMv8.4-SecEL2 speak for 4628 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 4629 * 4630 * Prior to that, the language was "In an implementation that 4631 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 4632 * as if this field is 0 for all purposes other than a direct 4633 * read or write access of HCR_EL2". With lots of enumeration 4634 * on a per-field basis. In current QEMU, this is condition 4635 * is arm_is_secure_below_el3. 4636 * 4637 * Since the v8.4 language applies to the entire register, and 4638 * appears to be backward compatible, use that. 4639 */ 4640 ret = 0; 4641 } else if (ret & HCR_TGE) { 4642 /* These bits are up-to-date as of ARMv8.4. */ 4643 if (ret & HCR_E2H) { 4644 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 4645 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 4646 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 4647 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE); 4648 } else { 4649 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 4650 } 4651 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 4652 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 4653 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 4654 HCR_TLOR); 4655 } 4656 4657 return ret; 4658 } 4659 4660 static const ARMCPRegInfo el2_cp_reginfo[] = { 4661 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 4662 .type = ARM_CP_IO, 4663 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4664 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4665 .writefn = hcr_write }, 4666 { .name = "HCR", .state = ARM_CP_STATE_AA32, 4667 .type = ARM_CP_ALIAS | ARM_CP_IO, 4668 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4669 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4670 .writefn = hcr_writelow }, 4671 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 4672 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 4673 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4674 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 4675 .type = ARM_CP_ALIAS, 4676 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 4677 .access = PL2_RW, 4678 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 4679 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4680 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4681 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 4682 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4683 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4684 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 4685 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4686 .type = ARM_CP_ALIAS, 4687 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4688 .access = PL2_RW, 4689 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 4690 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 4691 .type = ARM_CP_ALIAS, 4692 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 4693 .access = PL2_RW, 4694 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 4695 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4696 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4697 .access = PL2_RW, .writefn = vbar_write, 4698 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 4699 .resetvalue = 0 }, 4700 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 4701 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 4702 .access = PL3_RW, .type = ARM_CP_ALIAS, 4703 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 4704 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4705 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4706 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 4707 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]) }, 4708 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4709 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4710 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 4711 .resetvalue = 0 }, 4712 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4713 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4714 .access = PL2_RW, .type = ARM_CP_ALIAS, 4715 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 4716 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4717 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4718 .access = PL2_RW, .type = ARM_CP_CONST, 4719 .resetvalue = 0 }, 4720 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 4721 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4722 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4723 .access = PL2_RW, .type = ARM_CP_CONST, 4724 .resetvalue = 0 }, 4725 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4726 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4727 .access = PL2_RW, .type = ARM_CP_CONST, 4728 .resetvalue = 0 }, 4729 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4730 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4731 .access = PL2_RW, .type = ARM_CP_CONST, 4732 .resetvalue = 0 }, 4733 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4734 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4735 .access = PL2_RW, 4736 /* no .writefn needed as this can't cause an ASID change; 4737 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4738 */ 4739 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 4740 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 4741 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4742 .type = ARM_CP_ALIAS, 4743 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4744 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4745 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 4746 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4747 .access = PL2_RW, 4748 /* no .writefn needed as this can't cause an ASID change; 4749 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4750 */ 4751 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4752 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4753 .cp = 15, .opc1 = 6, .crm = 2, 4754 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4755 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4756 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 4757 .writefn = vttbr_write }, 4758 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4759 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4760 .access = PL2_RW, .writefn = vttbr_write, 4761 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 4762 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4763 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4764 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 4765 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 4766 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4767 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4768 .access = PL2_RW, .resetvalue = 0, 4769 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 4770 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4771 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4772 .access = PL2_RW, .resetvalue = 0, 4773 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4774 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4775 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4776 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4777 { .name = "TLBIALLNSNH", 4778 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4779 .type = ARM_CP_NO_RAW, .access = PL2_W, 4780 .writefn = tlbiall_nsnh_write }, 4781 { .name = "TLBIALLNSNHIS", 4782 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4783 .type = ARM_CP_NO_RAW, .access = PL2_W, 4784 .writefn = tlbiall_nsnh_is_write }, 4785 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4786 .type = ARM_CP_NO_RAW, .access = PL2_W, 4787 .writefn = tlbiall_hyp_write }, 4788 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4789 .type = ARM_CP_NO_RAW, .access = PL2_W, 4790 .writefn = tlbiall_hyp_is_write }, 4791 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4792 .type = ARM_CP_NO_RAW, .access = PL2_W, 4793 .writefn = tlbimva_hyp_write }, 4794 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4795 .type = ARM_CP_NO_RAW, .access = PL2_W, 4796 .writefn = tlbimva_hyp_is_write }, 4797 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 4798 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4799 .type = ARM_CP_NO_RAW, .access = PL2_W, 4800 .writefn = tlbi_aa64_alle2_write }, 4801 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 4802 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4803 .type = ARM_CP_NO_RAW, .access = PL2_W, 4804 .writefn = tlbi_aa64_vae2_write }, 4805 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 4806 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4807 .access = PL2_W, .type = ARM_CP_NO_RAW, 4808 .writefn = tlbi_aa64_vae2_write }, 4809 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 4810 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4811 .access = PL2_W, .type = ARM_CP_NO_RAW, 4812 .writefn = tlbi_aa64_alle2is_write }, 4813 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 4814 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4815 .type = ARM_CP_NO_RAW, .access = PL2_W, 4816 .writefn = tlbi_aa64_vae2is_write }, 4817 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 4818 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4819 .access = PL2_W, .type = ARM_CP_NO_RAW, 4820 .writefn = tlbi_aa64_vae2is_write }, 4821 #ifndef CONFIG_USER_ONLY 4822 /* Unlike the other EL2-related AT operations, these must 4823 * UNDEF from EL3 if EL2 is not implemented, which is why we 4824 * define them here rather than with the rest of the AT ops. 4825 */ 4826 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 4827 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4828 .access = PL2_W, .accessfn = at_s1e2_access, 4829 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4830 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 4831 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4832 .access = PL2_W, .accessfn = at_s1e2_access, 4833 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4834 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 4835 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 4836 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 4837 * to behave as if SCR.NS was 1. 4838 */ 4839 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4840 .access = PL2_W, 4841 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4842 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4843 .access = PL2_W, 4844 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4845 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4846 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4847 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 4848 * reset values as IMPDEF. We choose to reset to 3 to comply with 4849 * both ARMv7 and ARMv8. 4850 */ 4851 .access = PL2_RW, .resetvalue = 3, 4852 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 4853 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4854 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4855 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 4856 .writefn = gt_cntvoff_write, 4857 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4858 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4859 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 4860 .writefn = gt_cntvoff_write, 4861 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4862 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4863 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4864 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4865 .type = ARM_CP_IO, .access = PL2_RW, 4866 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4867 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4868 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4869 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 4870 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4871 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4872 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4873 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 4874 .resetfn = gt_hyp_timer_reset, 4875 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 4876 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4877 .type = ARM_CP_IO, 4878 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4879 .access = PL2_RW, 4880 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 4881 .resetvalue = 0, 4882 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 4883 #endif 4884 /* The only field of MDCR_EL2 that has a defined architectural reset value 4885 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we 4886 * don't implement any PMU event counters, so using zero as a reset 4887 * value for MDCR_EL2 is okay 4888 */ 4889 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4890 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4891 .access = PL2_RW, .resetvalue = 0, 4892 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), }, 4893 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 4894 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4895 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4896 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4897 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 4898 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4899 .access = PL2_RW, 4900 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4901 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4902 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4903 .access = PL2_RW, 4904 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 4905 REGINFO_SENTINEL 4906 }; 4907 4908 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 4909 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4910 .type = ARM_CP_ALIAS | ARM_CP_IO, 4911 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4912 .access = PL2_RW, 4913 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 4914 .writefn = hcr_writehigh }, 4915 REGINFO_SENTINEL 4916 }; 4917 4918 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 4919 bool isread) 4920 { 4921 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 4922 * At Secure EL1 it traps to EL3. 4923 */ 4924 if (arm_current_el(env) == 3) { 4925 return CP_ACCESS_OK; 4926 } 4927 if (arm_is_secure_below_el3(env)) { 4928 return CP_ACCESS_TRAP_EL3; 4929 } 4930 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 4931 if (isread) { 4932 return CP_ACCESS_OK; 4933 } 4934 return CP_ACCESS_TRAP_UNCATEGORIZED; 4935 } 4936 4937 static const ARMCPRegInfo el3_cp_reginfo[] = { 4938 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 4939 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 4940 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 4941 .resetvalue = 0, .writefn = scr_write }, 4942 { .name = "SCR", .type = ARM_CP_ALIAS, 4943 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 4944 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4945 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 4946 .writefn = scr_write }, 4947 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 4948 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 4949 .access = PL3_RW, .resetvalue = 0, 4950 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 4951 { .name = "SDER", 4952 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 4953 .access = PL3_RW, .resetvalue = 0, 4954 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 4955 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 4956 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4957 .writefn = vbar_write, .resetvalue = 0, 4958 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 4959 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 4960 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 4961 .access = PL3_RW, .resetvalue = 0, 4962 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 4963 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 4964 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 4965 .access = PL3_RW, 4966 /* no .writefn needed as this can't cause an ASID change; 4967 * we must provide a .raw_writefn and .resetfn because we handle 4968 * reset and migration for the AArch32 TTBCR(S), which might be 4969 * using mask and base_mask. 4970 */ 4971 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write, 4972 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 4973 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 4974 .type = ARM_CP_ALIAS, 4975 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 4976 .access = PL3_RW, 4977 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 4978 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 4979 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 4980 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 4981 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 4982 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 4983 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 4984 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 4985 .type = ARM_CP_ALIAS, 4986 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 4987 .access = PL3_RW, 4988 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 4989 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 4990 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 4991 .access = PL3_RW, .writefn = vbar_write, 4992 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 4993 .resetvalue = 0 }, 4994 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 4995 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 4996 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 4997 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 4998 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 4999 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 5000 .access = PL3_RW, .resetvalue = 0, 5001 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 5002 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 5003 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 5004 .access = PL3_RW, .type = ARM_CP_CONST, 5005 .resetvalue = 0 }, 5006 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 5007 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 5008 .access = PL3_RW, .type = ARM_CP_CONST, 5009 .resetvalue = 0 }, 5010 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 5011 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 5012 .access = PL3_RW, .type = ARM_CP_CONST, 5013 .resetvalue = 0 }, 5014 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 5015 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 5016 .access = PL3_W, .type = ARM_CP_NO_RAW, 5017 .writefn = tlbi_aa64_alle3is_write }, 5018 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 5019 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 5020 .access = PL3_W, .type = ARM_CP_NO_RAW, 5021 .writefn = tlbi_aa64_vae3is_write }, 5022 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 5023 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 5024 .access = PL3_W, .type = ARM_CP_NO_RAW, 5025 .writefn = tlbi_aa64_vae3is_write }, 5026 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 5027 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 5028 .access = PL3_W, .type = ARM_CP_NO_RAW, 5029 .writefn = tlbi_aa64_alle3_write }, 5030 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 5031 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 5032 .access = PL3_W, .type = ARM_CP_NO_RAW, 5033 .writefn = tlbi_aa64_vae3_write }, 5034 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 5035 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 5036 .access = PL3_W, .type = ARM_CP_NO_RAW, 5037 .writefn = tlbi_aa64_vae3_write }, 5038 REGINFO_SENTINEL 5039 }; 5040 5041 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 5042 bool isread) 5043 { 5044 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64, 5045 * but the AArch32 CTR has its own reginfo struct) 5046 */ 5047 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 5048 return CP_ACCESS_TRAP; 5049 } 5050 return CP_ACCESS_OK; 5051 } 5052 5053 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, 5054 uint64_t value) 5055 { 5056 /* Writes to OSLAR_EL1 may update the OS lock status, which can be 5057 * read via a bit in OSLSR_EL1. 5058 */ 5059 int oslock; 5060 5061 if (ri->state == ARM_CP_STATE_AA32) { 5062 oslock = (value == 0xC5ACCE55); 5063 } else { 5064 oslock = value & 1; 5065 } 5066 5067 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock); 5068 } 5069 5070 static const ARMCPRegInfo debug_cp_reginfo[] = { 5071 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped 5072 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; 5073 * unlike DBGDRAR it is never accessible from EL0. 5074 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64 5075 * accessor. 5076 */ 5077 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, 5078 .access = PL0_R, .accessfn = access_tdra, 5079 .type = ARM_CP_CONST, .resetvalue = 0 }, 5080 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, 5081 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 5082 .access = PL1_R, .accessfn = access_tdra, 5083 .type = ARM_CP_CONST, .resetvalue = 0 }, 5084 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 5085 .access = PL0_R, .accessfn = access_tdra, 5086 .type = ARM_CP_CONST, .resetvalue = 0 }, 5087 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ 5088 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, 5089 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5090 .access = PL1_RW, .accessfn = access_tda, 5091 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), 5092 .resetvalue = 0 }, 5093 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1. 5094 * We don't implement the configurable EL0 access. 5095 */ 5096 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH, 5097 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5098 .type = ARM_CP_ALIAS, 5099 .access = PL1_R, .accessfn = access_tda, 5100 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, 5101 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, 5102 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, 5103 .access = PL1_W, .type = ARM_CP_NO_RAW, 5104 .accessfn = access_tdosa, 5105 .writefn = oslar_write }, 5106 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, 5107 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, 5108 .access = PL1_R, .resetvalue = 10, 5109 .accessfn = access_tdosa, 5110 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, 5111 /* Dummy OSDLR_EL1: 32-bit Linux will read this */ 5112 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, 5113 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, 5114 .access = PL1_RW, .accessfn = access_tdosa, 5115 .type = ARM_CP_NOP }, 5116 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't 5117 * implement vector catch debug events yet. 5118 */ 5119 { .name = "DBGVCR", 5120 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 5121 .access = PL1_RW, .accessfn = access_tda, 5122 .type = ARM_CP_NOP }, 5123 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor 5124 * to save and restore a 32-bit guest's DBGVCR) 5125 */ 5126 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64, 5127 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0, 5128 .access = PL2_RW, .accessfn = access_tda, 5129 .type = ARM_CP_NOP }, 5130 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications 5131 * Channel but Linux may try to access this register. The 32-bit 5132 * alias is DBGDCCINT. 5133 */ 5134 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH, 5135 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5136 .access = PL1_RW, .accessfn = access_tda, 5137 .type = ARM_CP_NOP }, 5138 REGINFO_SENTINEL 5139 }; 5140 5141 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = { 5142 /* 64 bit access versions of the (dummy) debug registers */ 5143 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0, 5144 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5145 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0, 5146 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5147 REGINFO_SENTINEL 5148 }; 5149 5150 /* Return the exception level to which exceptions should be taken 5151 * via SVEAccessTrap. If an exception should be routed through 5152 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should 5153 * take care of raising that exception. 5154 * C.f. the ARM pseudocode function CheckSVEEnabled. 5155 */ 5156 int sve_exception_el(CPUARMState *env, int el) 5157 { 5158 #ifndef CONFIG_USER_ONLY 5159 if (el <= 1) { 5160 bool disabled = false; 5161 5162 /* The CPACR.ZEN controls traps to EL1: 5163 * 0, 2 : trap EL0 and EL1 accesses 5164 * 1 : trap only EL0 accesses 5165 * 3 : trap no accesses 5166 */ 5167 if (!extract32(env->cp15.cpacr_el1, 16, 1)) { 5168 disabled = true; 5169 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) { 5170 disabled = el == 0; 5171 } 5172 if (disabled) { 5173 /* route_to_el2 */ 5174 return (arm_feature(env, ARM_FEATURE_EL2) 5175 && (arm_hcr_el2_eff(env) & HCR_TGE) ? 2 : 1); 5176 } 5177 5178 /* Check CPACR.FPEN. */ 5179 if (!extract32(env->cp15.cpacr_el1, 20, 1)) { 5180 disabled = true; 5181 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) { 5182 disabled = el == 0; 5183 } 5184 if (disabled) { 5185 return 0; 5186 } 5187 } 5188 5189 /* CPTR_EL2. Since TZ and TFP are positive, 5190 * they will be zero when EL2 is not present. 5191 */ 5192 if (el <= 2 && !arm_is_secure_below_el3(env)) { 5193 if (env->cp15.cptr_el[2] & CPTR_TZ) { 5194 return 2; 5195 } 5196 if (env->cp15.cptr_el[2] & CPTR_TFP) { 5197 return 0; 5198 } 5199 } 5200 5201 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 5202 if (arm_feature(env, ARM_FEATURE_EL3) 5203 && !(env->cp15.cptr_el[3] & CPTR_EZ)) { 5204 return 3; 5205 } 5206 #endif 5207 return 0; 5208 } 5209 5210 /* 5211 * Given that SVE is enabled, return the vector length for EL. 5212 */ 5213 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) 5214 { 5215 ARMCPU *cpu = arm_env_get_cpu(env); 5216 uint32_t zcr_len = cpu->sve_max_vq - 1; 5217 5218 if (el <= 1) { 5219 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]); 5220 } 5221 if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) { 5222 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]); 5223 } 5224 if (el < 3 && arm_feature(env, ARM_FEATURE_EL3)) { 5225 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); 5226 } 5227 return zcr_len; 5228 } 5229 5230 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5231 uint64_t value) 5232 { 5233 int cur_el = arm_current_el(env); 5234 int old_len = sve_zcr_len_for_el(env, cur_el); 5235 int new_len; 5236 5237 /* Bits other than [3:0] are RAZ/WI. */ 5238 raw_write(env, ri, value & 0xf); 5239 5240 /* 5241 * Because we arrived here, we know both FP and SVE are enabled; 5242 * otherwise we would have trapped access to the ZCR_ELn register. 5243 */ 5244 new_len = sve_zcr_len_for_el(env, cur_el); 5245 if (new_len < old_len) { 5246 aarch64_sve_narrow_vq(env, new_len + 1); 5247 } 5248 } 5249 5250 static const ARMCPRegInfo zcr_el1_reginfo = { 5251 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 5252 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 5253 .access = PL1_RW, .type = ARM_CP_SVE, 5254 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 5255 .writefn = zcr_write, .raw_writefn = raw_write 5256 }; 5257 5258 static const ARMCPRegInfo zcr_el2_reginfo = { 5259 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5260 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5261 .access = PL2_RW, .type = ARM_CP_SVE, 5262 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 5263 .writefn = zcr_write, .raw_writefn = raw_write 5264 }; 5265 5266 static const ARMCPRegInfo zcr_no_el2_reginfo = { 5267 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5268 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5269 .access = PL2_RW, .type = ARM_CP_SVE, 5270 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore 5271 }; 5272 5273 static const ARMCPRegInfo zcr_el3_reginfo = { 5274 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 5275 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 5276 .access = PL3_RW, .type = ARM_CP_SVE, 5277 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 5278 .writefn = zcr_write, .raw_writefn = raw_write 5279 }; 5280 5281 void hw_watchpoint_update(ARMCPU *cpu, int n) 5282 { 5283 CPUARMState *env = &cpu->env; 5284 vaddr len = 0; 5285 vaddr wvr = env->cp15.dbgwvr[n]; 5286 uint64_t wcr = env->cp15.dbgwcr[n]; 5287 int mask; 5288 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 5289 5290 if (env->cpu_watchpoint[n]) { 5291 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); 5292 env->cpu_watchpoint[n] = NULL; 5293 } 5294 5295 if (!extract64(wcr, 0, 1)) { 5296 /* E bit clear : watchpoint disabled */ 5297 return; 5298 } 5299 5300 switch (extract64(wcr, 3, 2)) { 5301 case 0: 5302 /* LSC 00 is reserved and must behave as if the wp is disabled */ 5303 return; 5304 case 1: 5305 flags |= BP_MEM_READ; 5306 break; 5307 case 2: 5308 flags |= BP_MEM_WRITE; 5309 break; 5310 case 3: 5311 flags |= BP_MEM_ACCESS; 5312 break; 5313 } 5314 5315 /* Attempts to use both MASK and BAS fields simultaneously are 5316 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, 5317 * thus generating a watchpoint for every byte in the masked region. 5318 */ 5319 mask = extract64(wcr, 24, 4); 5320 if (mask == 1 || mask == 2) { 5321 /* Reserved values of MASK; we must act as if the mask value was 5322 * some non-reserved value, or as if the watchpoint were disabled. 5323 * We choose the latter. 5324 */ 5325 return; 5326 } else if (mask) { 5327 /* Watchpoint covers an aligned area up to 2GB in size */ 5328 len = 1ULL << mask; 5329 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE 5330 * whether the watchpoint fires when the unmasked bits match; we opt 5331 * to generate the exceptions. 5332 */ 5333 wvr &= ~(len - 1); 5334 } else { 5335 /* Watchpoint covers bytes defined by the byte address select bits */ 5336 int bas = extract64(wcr, 5, 8); 5337 int basstart; 5338 5339 if (bas == 0) { 5340 /* This must act as if the watchpoint is disabled */ 5341 return; 5342 } 5343 5344 if (extract64(wvr, 2, 1)) { 5345 /* Deprecated case of an only 4-aligned address. BAS[7:4] are 5346 * ignored, and BAS[3:0] define which bytes to watch. 5347 */ 5348 bas &= 0xf; 5349 } 5350 /* The BAS bits are supposed to be programmed to indicate a contiguous 5351 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether 5352 * we fire for each byte in the word/doubleword addressed by the WVR. 5353 * We choose to ignore any non-zero bits after the first range of 1s. 5354 */ 5355 basstart = ctz32(bas); 5356 len = cto32(bas >> basstart); 5357 wvr += basstart; 5358 } 5359 5360 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, 5361 &env->cpu_watchpoint[n]); 5362 } 5363 5364 void hw_watchpoint_update_all(ARMCPU *cpu) 5365 { 5366 int i; 5367 CPUARMState *env = &cpu->env; 5368 5369 /* Completely clear out existing QEMU watchpoints and our array, to 5370 * avoid possible stale entries following migration load. 5371 */ 5372 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); 5373 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); 5374 5375 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { 5376 hw_watchpoint_update(cpu, i); 5377 } 5378 } 5379 5380 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5381 uint64_t value) 5382 { 5383 ARMCPU *cpu = arm_env_get_cpu(env); 5384 int i = ri->crm; 5385 5386 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the 5387 * register reads and behaves as if values written are sign extended. 5388 * Bits [1:0] are RES0. 5389 */ 5390 value = sextract64(value, 0, 49) & ~3ULL; 5391 5392 raw_write(env, ri, value); 5393 hw_watchpoint_update(cpu, i); 5394 } 5395 5396 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5397 uint64_t value) 5398 { 5399 ARMCPU *cpu = arm_env_get_cpu(env); 5400 int i = ri->crm; 5401 5402 raw_write(env, ri, value); 5403 hw_watchpoint_update(cpu, i); 5404 } 5405 5406 void hw_breakpoint_update(ARMCPU *cpu, int n) 5407 { 5408 CPUARMState *env = &cpu->env; 5409 uint64_t bvr = env->cp15.dbgbvr[n]; 5410 uint64_t bcr = env->cp15.dbgbcr[n]; 5411 vaddr addr; 5412 int bt; 5413 int flags = BP_CPU; 5414 5415 if (env->cpu_breakpoint[n]) { 5416 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); 5417 env->cpu_breakpoint[n] = NULL; 5418 } 5419 5420 if (!extract64(bcr, 0, 1)) { 5421 /* E bit clear : watchpoint disabled */ 5422 return; 5423 } 5424 5425 bt = extract64(bcr, 20, 4); 5426 5427 switch (bt) { 5428 case 4: /* unlinked address mismatch (reserved if AArch64) */ 5429 case 5: /* linked address mismatch (reserved if AArch64) */ 5430 qemu_log_mask(LOG_UNIMP, 5431 "arm: address mismatch breakpoint types not implemented\n"); 5432 return; 5433 case 0: /* unlinked address match */ 5434 case 1: /* linked address match */ 5435 { 5436 /* Bits [63:49] are hardwired to the value of bit [48]; that is, 5437 * we behave as if the register was sign extended. Bits [1:0] are 5438 * RES0. The BAS field is used to allow setting breakpoints on 16 5439 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether 5440 * a bp will fire if the addresses covered by the bp and the addresses 5441 * covered by the insn overlap but the insn doesn't start at the 5442 * start of the bp address range. We choose to require the insn and 5443 * the bp to have the same address. The constraints on writing to 5444 * BAS enforced in dbgbcr_write mean we have only four cases: 5445 * 0b0000 => no breakpoint 5446 * 0b0011 => breakpoint on addr 5447 * 0b1100 => breakpoint on addr + 2 5448 * 0b1111 => breakpoint on addr 5449 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). 5450 */ 5451 int bas = extract64(bcr, 5, 4); 5452 addr = sextract64(bvr, 0, 49) & ~3ULL; 5453 if (bas == 0) { 5454 return; 5455 } 5456 if (bas == 0xc) { 5457 addr += 2; 5458 } 5459 break; 5460 } 5461 case 2: /* unlinked context ID match */ 5462 case 8: /* unlinked VMID match (reserved if no EL2) */ 5463 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ 5464 qemu_log_mask(LOG_UNIMP, 5465 "arm: unlinked context breakpoint types not implemented\n"); 5466 return; 5467 case 9: /* linked VMID match (reserved if no EL2) */ 5468 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 5469 case 3: /* linked context ID match */ 5470 default: 5471 /* We must generate no events for Linked context matches (unless 5472 * they are linked to by some other bp/wp, which is handled in 5473 * updates for the linking bp/wp). We choose to also generate no events 5474 * for reserved values. 5475 */ 5476 return; 5477 } 5478 5479 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); 5480 } 5481 5482 void hw_breakpoint_update_all(ARMCPU *cpu) 5483 { 5484 int i; 5485 CPUARMState *env = &cpu->env; 5486 5487 /* Completely clear out existing QEMU breakpoints and our array, to 5488 * avoid possible stale entries following migration load. 5489 */ 5490 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); 5491 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); 5492 5493 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { 5494 hw_breakpoint_update(cpu, i); 5495 } 5496 } 5497 5498 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5499 uint64_t value) 5500 { 5501 ARMCPU *cpu = arm_env_get_cpu(env); 5502 int i = ri->crm; 5503 5504 raw_write(env, ri, value); 5505 hw_breakpoint_update(cpu, i); 5506 } 5507 5508 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5509 uint64_t value) 5510 { 5511 ARMCPU *cpu = arm_env_get_cpu(env); 5512 int i = ri->crm; 5513 5514 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only 5515 * copy of BAS[0]. 5516 */ 5517 value = deposit64(value, 6, 1, extract64(value, 5, 1)); 5518 value = deposit64(value, 8, 1, extract64(value, 7, 1)); 5519 5520 raw_write(env, ri, value); 5521 hw_breakpoint_update(cpu, i); 5522 } 5523 5524 static void define_debug_regs(ARMCPU *cpu) 5525 { 5526 /* Define v7 and v8 architectural debug registers. 5527 * These are just dummy implementations for now. 5528 */ 5529 int i; 5530 int wrps, brps, ctx_cmps; 5531 ARMCPRegInfo dbgdidr = { 5532 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 5533 .access = PL0_R, .accessfn = access_tda, 5534 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, 5535 }; 5536 5537 /* Note that all these register fields hold "number of Xs minus 1". */ 5538 brps = extract32(cpu->dbgdidr, 24, 4); 5539 wrps = extract32(cpu->dbgdidr, 28, 4); 5540 ctx_cmps = extract32(cpu->dbgdidr, 20, 4); 5541 5542 assert(ctx_cmps <= brps); 5543 5544 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties 5545 * of the debug registers such as number of breakpoints; 5546 * check that if they both exist then they agree. 5547 */ 5548 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 5549 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps); 5550 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps); 5551 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps); 5552 } 5553 5554 define_one_arm_cp_reg(cpu, &dbgdidr); 5555 define_arm_cp_regs(cpu, debug_cp_reginfo); 5556 5557 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { 5558 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); 5559 } 5560 5561 for (i = 0; i < brps + 1; i++) { 5562 ARMCPRegInfo dbgregs[] = { 5563 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH, 5564 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, 5565 .access = PL1_RW, .accessfn = access_tda, 5566 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), 5567 .writefn = dbgbvr_write, .raw_writefn = raw_write 5568 }, 5569 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH, 5570 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, 5571 .access = PL1_RW, .accessfn = access_tda, 5572 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), 5573 .writefn = dbgbcr_write, .raw_writefn = raw_write 5574 }, 5575 REGINFO_SENTINEL 5576 }; 5577 define_arm_cp_regs(cpu, dbgregs); 5578 } 5579 5580 for (i = 0; i < wrps + 1; i++) { 5581 ARMCPRegInfo dbgregs[] = { 5582 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH, 5583 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, 5584 .access = PL1_RW, .accessfn = access_tda, 5585 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), 5586 .writefn = dbgwvr_write, .raw_writefn = raw_write 5587 }, 5588 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH, 5589 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, 5590 .access = PL1_RW, .accessfn = access_tda, 5591 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), 5592 .writefn = dbgwcr_write, .raw_writefn = raw_write 5593 }, 5594 REGINFO_SENTINEL 5595 }; 5596 define_arm_cp_regs(cpu, dbgregs); 5597 } 5598 } 5599 5600 /* We don't know until after realize whether there's a GICv3 5601 * attached, and that is what registers the gicv3 sysregs. 5602 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 5603 * at runtime. 5604 */ 5605 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 5606 { 5607 ARMCPU *cpu = arm_env_get_cpu(env); 5608 uint64_t pfr1 = cpu->id_pfr1; 5609 5610 if (env->gicv3state) { 5611 pfr1 |= 1 << 28; 5612 } 5613 return pfr1; 5614 } 5615 5616 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 5617 { 5618 ARMCPU *cpu = arm_env_get_cpu(env); 5619 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 5620 5621 if (env->gicv3state) { 5622 pfr0 |= 1 << 24; 5623 } 5624 return pfr0; 5625 } 5626 5627 /* Shared logic between LORID and the rest of the LOR* registers. 5628 * Secure state has already been delt with. 5629 */ 5630 static CPAccessResult access_lor_ns(CPUARMState *env) 5631 { 5632 int el = arm_current_el(env); 5633 5634 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 5635 return CP_ACCESS_TRAP_EL2; 5636 } 5637 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 5638 return CP_ACCESS_TRAP_EL3; 5639 } 5640 return CP_ACCESS_OK; 5641 } 5642 5643 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri, 5644 bool isread) 5645 { 5646 if (arm_is_secure_below_el3(env)) { 5647 /* Access ok in secure mode. */ 5648 return CP_ACCESS_OK; 5649 } 5650 return access_lor_ns(env); 5651 } 5652 5653 static CPAccessResult access_lor_other(CPUARMState *env, 5654 const ARMCPRegInfo *ri, bool isread) 5655 { 5656 if (arm_is_secure_below_el3(env)) { 5657 /* Access denied in secure mode. */ 5658 return CP_ACCESS_TRAP; 5659 } 5660 return access_lor_ns(env); 5661 } 5662 5663 #ifdef TARGET_AARCH64 5664 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 5665 bool isread) 5666 { 5667 int el = arm_current_el(env); 5668 5669 if (el < 2 && 5670 arm_feature(env, ARM_FEATURE_EL2) && 5671 !(arm_hcr_el2_eff(env) & HCR_APK)) { 5672 return CP_ACCESS_TRAP_EL2; 5673 } 5674 if (el < 3 && 5675 arm_feature(env, ARM_FEATURE_EL3) && 5676 !(env->cp15.scr_el3 & SCR_APK)) { 5677 return CP_ACCESS_TRAP_EL3; 5678 } 5679 return CP_ACCESS_OK; 5680 } 5681 5682 static const ARMCPRegInfo pauth_reginfo[] = { 5683 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5684 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 5685 .access = PL1_RW, .accessfn = access_pauth, 5686 .fieldoffset = offsetof(CPUARMState, apda_key.lo) }, 5687 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5688 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 5689 .access = PL1_RW, .accessfn = access_pauth, 5690 .fieldoffset = offsetof(CPUARMState, apda_key.hi) }, 5691 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5692 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 5693 .access = PL1_RW, .accessfn = access_pauth, 5694 .fieldoffset = offsetof(CPUARMState, apdb_key.lo) }, 5695 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5696 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 5697 .access = PL1_RW, .accessfn = access_pauth, 5698 .fieldoffset = offsetof(CPUARMState, apdb_key.hi) }, 5699 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5700 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 5701 .access = PL1_RW, .accessfn = access_pauth, 5702 .fieldoffset = offsetof(CPUARMState, apga_key.lo) }, 5703 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5704 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 5705 .access = PL1_RW, .accessfn = access_pauth, 5706 .fieldoffset = offsetof(CPUARMState, apga_key.hi) }, 5707 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5708 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 5709 .access = PL1_RW, .accessfn = access_pauth, 5710 .fieldoffset = offsetof(CPUARMState, apia_key.lo) }, 5711 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5712 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 5713 .access = PL1_RW, .accessfn = access_pauth, 5714 .fieldoffset = offsetof(CPUARMState, apia_key.hi) }, 5715 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5716 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 5717 .access = PL1_RW, .accessfn = access_pauth, 5718 .fieldoffset = offsetof(CPUARMState, apib_key.lo) }, 5719 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5720 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 5721 .access = PL1_RW, .accessfn = access_pauth, 5722 .fieldoffset = offsetof(CPUARMState, apib_key.hi) }, 5723 REGINFO_SENTINEL 5724 }; 5725 #endif 5726 5727 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri, 5728 bool isread) 5729 { 5730 int el = arm_current_el(env); 5731 5732 if (el == 0) { 5733 uint64_t sctlr = arm_sctlr(env, el); 5734 if (!(sctlr & SCTLR_EnRCTX)) { 5735 return CP_ACCESS_TRAP; 5736 } 5737 } else if (el == 1) { 5738 uint64_t hcr = arm_hcr_el2_eff(env); 5739 if (hcr & HCR_NV) { 5740 return CP_ACCESS_TRAP_EL2; 5741 } 5742 } 5743 return CP_ACCESS_OK; 5744 } 5745 5746 static const ARMCPRegInfo predinv_reginfo[] = { 5747 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64, 5748 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4, 5749 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5750 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64, 5751 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5, 5752 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5753 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64, 5754 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7, 5755 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5756 /* 5757 * Note the AArch32 opcodes have a different OPC1. 5758 */ 5759 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32, 5760 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4, 5761 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5762 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32, 5763 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5, 5764 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5765 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32, 5766 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7, 5767 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5768 REGINFO_SENTINEL 5769 }; 5770 5771 void register_cp_regs_for_features(ARMCPU *cpu) 5772 { 5773 /* Register all the coprocessor registers based on feature bits */ 5774 CPUARMState *env = &cpu->env; 5775 if (arm_feature(env, ARM_FEATURE_M)) { 5776 /* M profile has no coprocessor registers */ 5777 return; 5778 } 5779 5780 define_arm_cp_regs(cpu, cp_reginfo); 5781 if (!arm_feature(env, ARM_FEATURE_V8)) { 5782 /* Must go early as it is full of wildcards that may be 5783 * overridden by later definitions. 5784 */ 5785 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 5786 } 5787 5788 if (arm_feature(env, ARM_FEATURE_V6)) { 5789 /* The ID registers all have impdef reset values */ 5790 ARMCPRegInfo v6_idregs[] = { 5791 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 5792 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5793 .access = PL1_R, .type = ARM_CP_CONST, 5794 .resetvalue = cpu->id_pfr0 }, 5795 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know 5796 * the value of the GIC field until after we define these regs. 5797 */ 5798 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 5799 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 5800 .access = PL1_R, .type = ARM_CP_NO_RAW, 5801 .readfn = id_pfr1_read, 5802 .writefn = arm_cp_write_ignore }, 5803 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 5804 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 5805 .access = PL1_R, .type = ARM_CP_CONST, 5806 .resetvalue = cpu->id_dfr0 }, 5807 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 5808 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 5809 .access = PL1_R, .type = ARM_CP_CONST, 5810 .resetvalue = cpu->id_afr0 }, 5811 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 5812 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 5813 .access = PL1_R, .type = ARM_CP_CONST, 5814 .resetvalue = cpu->id_mmfr0 }, 5815 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 5816 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 5817 .access = PL1_R, .type = ARM_CP_CONST, 5818 .resetvalue = cpu->id_mmfr1 }, 5819 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 5820 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 5821 .access = PL1_R, .type = ARM_CP_CONST, 5822 .resetvalue = cpu->id_mmfr2 }, 5823 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 5824 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 5825 .access = PL1_R, .type = ARM_CP_CONST, 5826 .resetvalue = cpu->id_mmfr3 }, 5827 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 5828 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5829 .access = PL1_R, .type = ARM_CP_CONST, 5830 .resetvalue = cpu->isar.id_isar0 }, 5831 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 5832 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 5833 .access = PL1_R, .type = ARM_CP_CONST, 5834 .resetvalue = cpu->isar.id_isar1 }, 5835 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 5836 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5837 .access = PL1_R, .type = ARM_CP_CONST, 5838 .resetvalue = cpu->isar.id_isar2 }, 5839 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 5840 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 5841 .access = PL1_R, .type = ARM_CP_CONST, 5842 .resetvalue = cpu->isar.id_isar3 }, 5843 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 5844 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 5845 .access = PL1_R, .type = ARM_CP_CONST, 5846 .resetvalue = cpu->isar.id_isar4 }, 5847 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 5848 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 5849 .access = PL1_R, .type = ARM_CP_CONST, 5850 .resetvalue = cpu->isar.id_isar5 }, 5851 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 5852 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 5853 .access = PL1_R, .type = ARM_CP_CONST, 5854 .resetvalue = cpu->id_mmfr4 }, 5855 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 5856 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 5857 .access = PL1_R, .type = ARM_CP_CONST, 5858 .resetvalue = cpu->isar.id_isar6 }, 5859 REGINFO_SENTINEL 5860 }; 5861 define_arm_cp_regs(cpu, v6_idregs); 5862 define_arm_cp_regs(cpu, v6_cp_reginfo); 5863 } else { 5864 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 5865 } 5866 if (arm_feature(env, ARM_FEATURE_V6K)) { 5867 define_arm_cp_regs(cpu, v6k_cp_reginfo); 5868 } 5869 if (arm_feature(env, ARM_FEATURE_V7MP) && 5870 !arm_feature(env, ARM_FEATURE_PMSA)) { 5871 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 5872 } 5873 if (arm_feature(env, ARM_FEATURE_V7VE)) { 5874 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 5875 } 5876 if (arm_feature(env, ARM_FEATURE_V7)) { 5877 /* v7 performance monitor control register: same implementor 5878 * field as main ID register, and we implement four counters in 5879 * addition to the cycle count register. 5880 */ 5881 unsigned int i, pmcrn = 4; 5882 ARMCPRegInfo pmcr = { 5883 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 5884 .access = PL0_RW, 5885 .type = ARM_CP_IO | ARM_CP_ALIAS, 5886 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 5887 .accessfn = pmreg_access, .writefn = pmcr_write, 5888 .raw_writefn = raw_write, 5889 }; 5890 ARMCPRegInfo pmcr64 = { 5891 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 5892 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 5893 .access = PL0_RW, .accessfn = pmreg_access, 5894 .type = ARM_CP_IO, 5895 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 5896 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT), 5897 .writefn = pmcr_write, .raw_writefn = raw_write, 5898 }; 5899 define_one_arm_cp_reg(cpu, &pmcr); 5900 define_one_arm_cp_reg(cpu, &pmcr64); 5901 for (i = 0; i < pmcrn; i++) { 5902 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 5903 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 5904 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 5905 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 5906 ARMCPRegInfo pmev_regs[] = { 5907 { .name = pmevcntr_name, .cp = 15, .crn = 14, 5908 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 5909 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 5910 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 5911 .accessfn = pmreg_access }, 5912 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 5913 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)), 5914 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 5915 .type = ARM_CP_IO, 5916 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 5917 .raw_readfn = pmevcntr_rawread, 5918 .raw_writefn = pmevcntr_rawwrite }, 5919 { .name = pmevtyper_name, .cp = 15, .crn = 14, 5920 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 5921 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 5922 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 5923 .accessfn = pmreg_access }, 5924 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 5925 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)), 5926 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 5927 .type = ARM_CP_IO, 5928 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 5929 .raw_writefn = pmevtyper_rawwrite }, 5930 REGINFO_SENTINEL 5931 }; 5932 define_arm_cp_regs(cpu, pmev_regs); 5933 g_free(pmevcntr_name); 5934 g_free(pmevcntr_el0_name); 5935 g_free(pmevtyper_name); 5936 g_free(pmevtyper_el0_name); 5937 } 5938 ARMCPRegInfo clidr = { 5939 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 5940 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 5941 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr 5942 }; 5943 define_one_arm_cp_reg(cpu, &clidr); 5944 define_arm_cp_regs(cpu, v7_cp_reginfo); 5945 define_debug_regs(cpu); 5946 } else { 5947 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 5948 } 5949 if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 && 5950 FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) { 5951 ARMCPRegInfo v81_pmu_regs[] = { 5952 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 5953 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 5954 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5955 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 5956 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 5957 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 5958 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5959 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 5960 REGINFO_SENTINEL 5961 }; 5962 define_arm_cp_regs(cpu, v81_pmu_regs); 5963 } 5964 if (arm_feature(env, ARM_FEATURE_V8)) { 5965 /* AArch64 ID registers, which all have impdef reset values. 5966 * Note that within the ID register ranges the unused slots 5967 * must all RAZ, not UNDEF; future architecture versions may 5968 * define new registers here. 5969 */ 5970 ARMCPRegInfo v8_idregs[] = { 5971 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't 5972 * know the right value for the GIC field until after we 5973 * define these regs. 5974 */ 5975 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 5976 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 5977 .access = PL1_R, .type = ARM_CP_NO_RAW, 5978 .readfn = id_aa64pfr0_read, 5979 .writefn = arm_cp_write_ignore }, 5980 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 5981 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 5982 .access = PL1_R, .type = ARM_CP_CONST, 5983 .resetvalue = cpu->isar.id_aa64pfr1}, 5984 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5985 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 5986 .access = PL1_R, .type = ARM_CP_CONST, 5987 .resetvalue = 0 }, 5988 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5989 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 5990 .access = PL1_R, .type = ARM_CP_CONST, 5991 .resetvalue = 0 }, 5992 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 5993 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 5994 .access = PL1_R, .type = ARM_CP_CONST, 5995 /* At present, only SVEver == 0 is defined anyway. */ 5996 .resetvalue = 0 }, 5997 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5998 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 5999 .access = PL1_R, .type = ARM_CP_CONST, 6000 .resetvalue = 0 }, 6001 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6002 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 6003 .access = PL1_R, .type = ARM_CP_CONST, 6004 .resetvalue = 0 }, 6005 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6006 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 6007 .access = PL1_R, .type = ARM_CP_CONST, 6008 .resetvalue = 0 }, 6009 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 6010 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 6011 .access = PL1_R, .type = ARM_CP_CONST, 6012 .resetvalue = cpu->id_aa64dfr0 }, 6013 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 6014 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 6015 .access = PL1_R, .type = ARM_CP_CONST, 6016 .resetvalue = cpu->id_aa64dfr1 }, 6017 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6018 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 6019 .access = PL1_R, .type = ARM_CP_CONST, 6020 .resetvalue = 0 }, 6021 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6022 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 6023 .access = PL1_R, .type = ARM_CP_CONST, 6024 .resetvalue = 0 }, 6025 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 6026 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 6027 .access = PL1_R, .type = ARM_CP_CONST, 6028 .resetvalue = cpu->id_aa64afr0 }, 6029 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 6030 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 6031 .access = PL1_R, .type = ARM_CP_CONST, 6032 .resetvalue = cpu->id_aa64afr1 }, 6033 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6034 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 6035 .access = PL1_R, .type = ARM_CP_CONST, 6036 .resetvalue = 0 }, 6037 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6038 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 6039 .access = PL1_R, .type = ARM_CP_CONST, 6040 .resetvalue = 0 }, 6041 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 6042 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 6043 .access = PL1_R, .type = ARM_CP_CONST, 6044 .resetvalue = cpu->isar.id_aa64isar0 }, 6045 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 6046 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 6047 .access = PL1_R, .type = ARM_CP_CONST, 6048 .resetvalue = cpu->isar.id_aa64isar1 }, 6049 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6050 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 6051 .access = PL1_R, .type = ARM_CP_CONST, 6052 .resetvalue = 0 }, 6053 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6054 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 6055 .access = PL1_R, .type = ARM_CP_CONST, 6056 .resetvalue = 0 }, 6057 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6058 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 6059 .access = PL1_R, .type = ARM_CP_CONST, 6060 .resetvalue = 0 }, 6061 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6062 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 6063 .access = PL1_R, .type = ARM_CP_CONST, 6064 .resetvalue = 0 }, 6065 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6066 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 6067 .access = PL1_R, .type = ARM_CP_CONST, 6068 .resetvalue = 0 }, 6069 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6070 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 6071 .access = PL1_R, .type = ARM_CP_CONST, 6072 .resetvalue = 0 }, 6073 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 6074 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 6075 .access = PL1_R, .type = ARM_CP_CONST, 6076 .resetvalue = cpu->isar.id_aa64mmfr0 }, 6077 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 6078 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 6079 .access = PL1_R, .type = ARM_CP_CONST, 6080 .resetvalue = cpu->isar.id_aa64mmfr1 }, 6081 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6082 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 6083 .access = PL1_R, .type = ARM_CP_CONST, 6084 .resetvalue = 0 }, 6085 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6086 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 6087 .access = PL1_R, .type = ARM_CP_CONST, 6088 .resetvalue = 0 }, 6089 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6090 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 6091 .access = PL1_R, .type = ARM_CP_CONST, 6092 .resetvalue = 0 }, 6093 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6094 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 6095 .access = PL1_R, .type = ARM_CP_CONST, 6096 .resetvalue = 0 }, 6097 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6098 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 6099 .access = PL1_R, .type = ARM_CP_CONST, 6100 .resetvalue = 0 }, 6101 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6102 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 6103 .access = PL1_R, .type = ARM_CP_CONST, 6104 .resetvalue = 0 }, 6105 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 6106 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 6107 .access = PL1_R, .type = ARM_CP_CONST, 6108 .resetvalue = cpu->isar.mvfr0 }, 6109 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 6110 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 6111 .access = PL1_R, .type = ARM_CP_CONST, 6112 .resetvalue = cpu->isar.mvfr1 }, 6113 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 6114 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 6115 .access = PL1_R, .type = ARM_CP_CONST, 6116 .resetvalue = cpu->isar.mvfr2 }, 6117 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6118 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 6119 .access = PL1_R, .type = ARM_CP_CONST, 6120 .resetvalue = 0 }, 6121 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6122 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 6123 .access = PL1_R, .type = ARM_CP_CONST, 6124 .resetvalue = 0 }, 6125 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6126 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 6127 .access = PL1_R, .type = ARM_CP_CONST, 6128 .resetvalue = 0 }, 6129 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6130 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 6131 .access = PL1_R, .type = ARM_CP_CONST, 6132 .resetvalue = 0 }, 6133 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6134 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 6135 .access = PL1_R, .type = ARM_CP_CONST, 6136 .resetvalue = 0 }, 6137 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 6138 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 6139 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6140 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 6141 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 6142 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 6143 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6144 .resetvalue = cpu->pmceid0 }, 6145 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 6146 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 6147 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6148 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 6149 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 6150 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 6151 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6152 .resetvalue = cpu->pmceid1 }, 6153 REGINFO_SENTINEL 6154 }; 6155 #ifdef CONFIG_USER_ONLY 6156 ARMCPRegUserSpaceInfo v8_user_idregs[] = { 6157 { .name = "ID_AA64PFR0_EL1", 6158 .exported_bits = 0x000f000f00ff0000, 6159 .fixed_bits = 0x0000000000000011 }, 6160 { .name = "ID_AA64PFR1_EL1", 6161 .exported_bits = 0x00000000000000f0 }, 6162 { .name = "ID_AA64PFR*_EL1_RESERVED", 6163 .is_glob = true }, 6164 { .name = "ID_AA64ZFR0_EL1" }, 6165 { .name = "ID_AA64MMFR0_EL1", 6166 .fixed_bits = 0x00000000ff000000 }, 6167 { .name = "ID_AA64MMFR1_EL1" }, 6168 { .name = "ID_AA64MMFR*_EL1_RESERVED", 6169 .is_glob = true }, 6170 { .name = "ID_AA64DFR0_EL1", 6171 .fixed_bits = 0x0000000000000006 }, 6172 { .name = "ID_AA64DFR1_EL1" }, 6173 { .name = "ID_AA64DFR*_EL1_RESERVED", 6174 .is_glob = true }, 6175 { .name = "ID_AA64AFR*", 6176 .is_glob = true }, 6177 { .name = "ID_AA64ISAR0_EL1", 6178 .exported_bits = 0x00fffffff0fffff0 }, 6179 { .name = "ID_AA64ISAR1_EL1", 6180 .exported_bits = 0x000000f0ffffffff }, 6181 { .name = "ID_AA64ISAR*_EL1_RESERVED", 6182 .is_glob = true }, 6183 REGUSERINFO_SENTINEL 6184 }; 6185 modify_arm_cp_regs(v8_idregs, v8_user_idregs); 6186 #endif 6187 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ 6188 if (!arm_feature(env, ARM_FEATURE_EL3) && 6189 !arm_feature(env, ARM_FEATURE_EL2)) { 6190 ARMCPRegInfo rvbar = { 6191 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64, 6192 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 6193 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar 6194 }; 6195 define_one_arm_cp_reg(cpu, &rvbar); 6196 } 6197 define_arm_cp_regs(cpu, v8_idregs); 6198 define_arm_cp_regs(cpu, v8_cp_reginfo); 6199 } 6200 if (arm_feature(env, ARM_FEATURE_EL2)) { 6201 uint64_t vmpidr_def = mpidr_read_val(env); 6202 ARMCPRegInfo vpidr_regs[] = { 6203 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 6204 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6205 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6206 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS, 6207 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 6208 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 6209 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6210 .access = PL2_RW, .resetvalue = cpu->midr, 6211 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6212 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 6213 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6214 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6215 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS, 6216 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 6217 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 6218 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6219 .access = PL2_RW, 6220 .resetvalue = vmpidr_def, 6221 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 6222 REGINFO_SENTINEL 6223 }; 6224 define_arm_cp_regs(cpu, vpidr_regs); 6225 define_arm_cp_regs(cpu, el2_cp_reginfo); 6226 if (arm_feature(env, ARM_FEATURE_V8)) { 6227 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 6228 } 6229 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */ 6230 if (!arm_feature(env, ARM_FEATURE_EL3)) { 6231 ARMCPRegInfo rvbar = { 6232 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 6233 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 6234 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar 6235 }; 6236 define_one_arm_cp_reg(cpu, &rvbar); 6237 } 6238 } else { 6239 /* If EL2 is missing but higher ELs are enabled, we need to 6240 * register the no_el2 reginfos. 6241 */ 6242 if (arm_feature(env, ARM_FEATURE_EL3)) { 6243 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value 6244 * of MIDR_EL1 and MPIDR_EL1. 6245 */ 6246 ARMCPRegInfo vpidr_regs[] = { 6247 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6248 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6249 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6250 .type = ARM_CP_CONST, .resetvalue = cpu->midr, 6251 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6252 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6253 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6254 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6255 .type = ARM_CP_NO_RAW, 6256 .writefn = arm_cp_write_ignore, .readfn = mpidr_read }, 6257 REGINFO_SENTINEL 6258 }; 6259 define_arm_cp_regs(cpu, vpidr_regs); 6260 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo); 6261 if (arm_feature(env, ARM_FEATURE_V8)) { 6262 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo); 6263 } 6264 } 6265 } 6266 if (arm_feature(env, ARM_FEATURE_EL3)) { 6267 define_arm_cp_regs(cpu, el3_cp_reginfo); 6268 ARMCPRegInfo el3_regs[] = { 6269 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 6270 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 6271 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar }, 6272 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 6273 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 6274 .access = PL3_RW, 6275 .raw_writefn = raw_write, .writefn = sctlr_write, 6276 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 6277 .resetvalue = cpu->reset_sctlr }, 6278 REGINFO_SENTINEL 6279 }; 6280 6281 define_arm_cp_regs(cpu, el3_regs); 6282 } 6283 /* The behaviour of NSACR is sufficiently various that we don't 6284 * try to describe it in a single reginfo: 6285 * if EL3 is 64 bit, then trap to EL3 from S EL1, 6286 * reads as constant 0xc00 from NS EL1 and NS EL2 6287 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 6288 * if v7 without EL3, register doesn't exist 6289 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 6290 */ 6291 if (arm_feature(env, ARM_FEATURE_EL3)) { 6292 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6293 ARMCPRegInfo nsacr = { 6294 .name = "NSACR", .type = ARM_CP_CONST, 6295 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6296 .access = PL1_RW, .accessfn = nsacr_access, 6297 .resetvalue = 0xc00 6298 }; 6299 define_one_arm_cp_reg(cpu, &nsacr); 6300 } else { 6301 ARMCPRegInfo nsacr = { 6302 .name = "NSACR", 6303 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6304 .access = PL3_RW | PL1_R, 6305 .resetvalue = 0, 6306 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 6307 }; 6308 define_one_arm_cp_reg(cpu, &nsacr); 6309 } 6310 } else { 6311 if (arm_feature(env, ARM_FEATURE_V8)) { 6312 ARMCPRegInfo nsacr = { 6313 .name = "NSACR", .type = ARM_CP_CONST, 6314 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6315 .access = PL1_R, 6316 .resetvalue = 0xc00 6317 }; 6318 define_one_arm_cp_reg(cpu, &nsacr); 6319 } 6320 } 6321 6322 if (arm_feature(env, ARM_FEATURE_PMSA)) { 6323 if (arm_feature(env, ARM_FEATURE_V6)) { 6324 /* PMSAv6 not implemented */ 6325 assert(arm_feature(env, ARM_FEATURE_V7)); 6326 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6327 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 6328 } else { 6329 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 6330 } 6331 } else { 6332 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6333 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 6334 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */ 6335 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) { 6336 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 6337 } 6338 } 6339 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 6340 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 6341 } 6342 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 6343 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 6344 } 6345 if (arm_feature(env, ARM_FEATURE_VAPA)) { 6346 define_arm_cp_regs(cpu, vapa_cp_reginfo); 6347 } 6348 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 6349 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 6350 } 6351 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 6352 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 6353 } 6354 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 6355 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 6356 } 6357 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 6358 define_arm_cp_regs(cpu, omap_cp_reginfo); 6359 } 6360 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 6361 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 6362 } 6363 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6364 define_arm_cp_regs(cpu, xscale_cp_reginfo); 6365 } 6366 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 6367 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 6368 } 6369 if (arm_feature(env, ARM_FEATURE_LPAE)) { 6370 define_arm_cp_regs(cpu, lpae_cp_reginfo); 6371 } 6372 /* Slightly awkwardly, the OMAP and StrongARM cores need all of 6373 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 6374 * be read-only (ie write causes UNDEF exception). 6375 */ 6376 { 6377 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 6378 /* Pre-v8 MIDR space. 6379 * Note that the MIDR isn't a simple constant register because 6380 * of the TI925 behaviour where writes to another register can 6381 * cause the MIDR value to change. 6382 * 6383 * Unimplemented registers in the c15 0 0 0 space default to 6384 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 6385 * and friends override accordingly. 6386 */ 6387 { .name = "MIDR", 6388 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 6389 .access = PL1_R, .resetvalue = cpu->midr, 6390 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 6391 .readfn = midr_read, 6392 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6393 .type = ARM_CP_OVERRIDE }, 6394 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 6395 { .name = "DUMMY", 6396 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 6397 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6398 { .name = "DUMMY", 6399 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 6400 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6401 { .name = "DUMMY", 6402 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 6403 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6404 { .name = "DUMMY", 6405 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 6406 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6407 { .name = "DUMMY", 6408 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 6409 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6410 REGINFO_SENTINEL 6411 }; 6412 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 6413 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 6414 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 6415 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 6416 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6417 .readfn = midr_read }, 6418 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */ 6419 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6420 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6421 .access = PL1_R, .resetvalue = cpu->midr }, 6422 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6423 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 6424 .access = PL1_R, .resetvalue = cpu->midr }, 6425 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 6426 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 6427 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 6428 REGINFO_SENTINEL 6429 }; 6430 ARMCPRegInfo id_cp_reginfo[] = { 6431 /* These are common to v8 and pre-v8 */ 6432 { .name = "CTR", 6433 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 6434 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6435 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 6436 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 6437 .access = PL0_R, .accessfn = ctr_el0_access, 6438 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6439 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 6440 { .name = "TCMTR", 6441 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 6442 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6443 REGINFO_SENTINEL 6444 }; 6445 /* TLBTR is specific to VMSA */ 6446 ARMCPRegInfo id_tlbtr_reginfo = { 6447 .name = "TLBTR", 6448 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 6449 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0, 6450 }; 6451 /* MPUIR is specific to PMSA V6+ */ 6452 ARMCPRegInfo id_mpuir_reginfo = { 6453 .name = "MPUIR", 6454 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6455 .access = PL1_R, .type = ARM_CP_CONST, 6456 .resetvalue = cpu->pmsav7_dregion << 8 6457 }; 6458 ARMCPRegInfo crn0_wi_reginfo = { 6459 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 6460 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 6461 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 6462 }; 6463 #ifdef CONFIG_USER_ONLY 6464 ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = { 6465 { .name = "MIDR_EL1", 6466 .exported_bits = 0x00000000ffffffff }, 6467 { .name = "REVIDR_EL1" }, 6468 REGUSERINFO_SENTINEL 6469 }; 6470 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo); 6471 #endif 6472 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 6473 arm_feature(env, ARM_FEATURE_STRONGARM)) { 6474 ARMCPRegInfo *r; 6475 /* Register the blanket "writes ignored" value first to cover the 6476 * whole space. Then update the specific ID registers to allow write 6477 * access, so that they ignore writes rather than causing them to 6478 * UNDEF. 6479 */ 6480 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 6481 for (r = id_pre_v8_midr_cp_reginfo; 6482 r->type != ARM_CP_SENTINEL; r++) { 6483 r->access = PL1_RW; 6484 } 6485 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) { 6486 r->access = PL1_RW; 6487 } 6488 id_mpuir_reginfo.access = PL1_RW; 6489 id_tlbtr_reginfo.access = PL1_RW; 6490 } 6491 if (arm_feature(env, ARM_FEATURE_V8)) { 6492 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 6493 } else { 6494 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 6495 } 6496 define_arm_cp_regs(cpu, id_cp_reginfo); 6497 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 6498 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 6499 } else if (arm_feature(env, ARM_FEATURE_V7)) { 6500 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 6501 } 6502 } 6503 6504 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 6505 ARMCPRegInfo mpidr_cp_reginfo[] = { 6506 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH, 6507 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 6508 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 6509 REGINFO_SENTINEL 6510 }; 6511 #ifdef CONFIG_USER_ONLY 6512 ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = { 6513 { .name = "MPIDR_EL1", 6514 .fixed_bits = 0x0000000080000000 }, 6515 REGUSERINFO_SENTINEL 6516 }; 6517 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo); 6518 #endif 6519 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 6520 } 6521 6522 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 6523 ARMCPRegInfo auxcr_reginfo[] = { 6524 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 6525 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 6526 .access = PL1_RW, .type = ARM_CP_CONST, 6527 .resetvalue = cpu->reset_auxcr }, 6528 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 6529 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 6530 .access = PL2_RW, .type = ARM_CP_CONST, 6531 .resetvalue = 0 }, 6532 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 6533 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 6534 .access = PL3_RW, .type = ARM_CP_CONST, 6535 .resetvalue = 0 }, 6536 REGINFO_SENTINEL 6537 }; 6538 define_arm_cp_regs(cpu, auxcr_reginfo); 6539 if (arm_feature(env, ARM_FEATURE_V8)) { 6540 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */ 6541 ARMCPRegInfo hactlr2_reginfo = { 6542 .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 6543 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 6544 .access = PL2_RW, .type = ARM_CP_CONST, 6545 .resetvalue = 0 6546 }; 6547 define_one_arm_cp_reg(cpu, &hactlr2_reginfo); 6548 } 6549 } 6550 6551 if (arm_feature(env, ARM_FEATURE_CBAR)) { 6552 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6553 /* 32 bit view is [31:18] 0...0 [43:32]. */ 6554 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 6555 | extract64(cpu->reset_cbar, 32, 12); 6556 ARMCPRegInfo cbar_reginfo[] = { 6557 { .name = "CBAR", 6558 .type = ARM_CP_CONST, 6559 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6560 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 6561 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 6562 .type = ARM_CP_CONST, 6563 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 6564 .access = PL1_R, .resetvalue = cbar32 }, 6565 REGINFO_SENTINEL 6566 }; 6567 /* We don't implement a r/w 64 bit CBAR currently */ 6568 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 6569 define_arm_cp_regs(cpu, cbar_reginfo); 6570 } else { 6571 ARMCPRegInfo cbar = { 6572 .name = "CBAR", 6573 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6574 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar, 6575 .fieldoffset = offsetof(CPUARMState, 6576 cp15.c15_config_base_address) 6577 }; 6578 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 6579 cbar.access = PL1_R; 6580 cbar.fieldoffset = 0; 6581 cbar.type = ARM_CP_CONST; 6582 } 6583 define_one_arm_cp_reg(cpu, &cbar); 6584 } 6585 } 6586 6587 if (arm_feature(env, ARM_FEATURE_VBAR)) { 6588 ARMCPRegInfo vbar_cp_reginfo[] = { 6589 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 6590 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 6591 .access = PL1_RW, .writefn = vbar_write, 6592 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 6593 offsetof(CPUARMState, cp15.vbar_ns) }, 6594 .resetvalue = 0 }, 6595 REGINFO_SENTINEL 6596 }; 6597 define_arm_cp_regs(cpu, vbar_cp_reginfo); 6598 } 6599 6600 /* Generic registers whose values depend on the implementation */ 6601 { 6602 ARMCPRegInfo sctlr = { 6603 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 6604 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 6605 .access = PL1_RW, 6606 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 6607 offsetof(CPUARMState, cp15.sctlr_ns) }, 6608 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 6609 .raw_writefn = raw_write, 6610 }; 6611 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6612 /* Normally we would always end the TB on an SCTLR write, but Linux 6613 * arch/arm/mach-pxa/sleep.S expects two instructions following 6614 * an MMU enable to execute from cache. Imitate this behaviour. 6615 */ 6616 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 6617 } 6618 define_one_arm_cp_reg(cpu, &sctlr); 6619 } 6620 6621 if (cpu_isar_feature(aa64_lor, cpu)) { 6622 /* 6623 * A trivial implementation of ARMv8.1-LOR leaves all of these 6624 * registers fixed at 0, which indicates that there are zero 6625 * supported Limited Ordering regions. 6626 */ 6627 static const ARMCPRegInfo lor_reginfo[] = { 6628 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 6629 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 6630 .access = PL1_RW, .accessfn = access_lor_other, 6631 .type = ARM_CP_CONST, .resetvalue = 0 }, 6632 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 6633 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 6634 .access = PL1_RW, .accessfn = access_lor_other, 6635 .type = ARM_CP_CONST, .resetvalue = 0 }, 6636 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 6637 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 6638 .access = PL1_RW, .accessfn = access_lor_other, 6639 .type = ARM_CP_CONST, .resetvalue = 0 }, 6640 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 6641 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 6642 .access = PL1_RW, .accessfn = access_lor_other, 6643 .type = ARM_CP_CONST, .resetvalue = 0 }, 6644 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 6645 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 6646 .access = PL1_R, .accessfn = access_lorid, 6647 .type = ARM_CP_CONST, .resetvalue = 0 }, 6648 REGINFO_SENTINEL 6649 }; 6650 define_arm_cp_regs(cpu, lor_reginfo); 6651 } 6652 6653 if (cpu_isar_feature(aa64_sve, cpu)) { 6654 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo); 6655 if (arm_feature(env, ARM_FEATURE_EL2)) { 6656 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo); 6657 } else { 6658 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo); 6659 } 6660 if (arm_feature(env, ARM_FEATURE_EL3)) { 6661 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo); 6662 } 6663 } 6664 6665 #ifdef TARGET_AARCH64 6666 if (cpu_isar_feature(aa64_pauth, cpu)) { 6667 define_arm_cp_regs(cpu, pauth_reginfo); 6668 } 6669 #endif 6670 6671 /* 6672 * While all v8.0 cpus support aarch64, QEMU does have configurations 6673 * that do not set ID_AA64ISAR1, e.g. user-only qemu-arm -cpu max, 6674 * which will set ID_ISAR6. 6675 */ 6676 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) 6677 ? cpu_isar_feature(aa64_predinv, cpu) 6678 : cpu_isar_feature(aa32_predinv, cpu)) { 6679 define_arm_cp_regs(cpu, predinv_reginfo); 6680 } 6681 } 6682 6683 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) 6684 { 6685 CPUState *cs = CPU(cpu); 6686 CPUARMState *env = &cpu->env; 6687 6688 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6689 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg, 6690 aarch64_fpu_gdb_set_reg, 6691 34, "aarch64-fpu.xml", 0); 6692 } else if (arm_feature(env, ARM_FEATURE_NEON)) { 6693 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6694 51, "arm-neon.xml", 0); 6695 } else if (arm_feature(env, ARM_FEATURE_VFP3)) { 6696 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6697 35, "arm-vfp3.xml", 0); 6698 } else if (arm_feature(env, ARM_FEATURE_VFP)) { 6699 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6700 19, "arm-vfp.xml", 0); 6701 } 6702 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg, 6703 arm_gen_dynamic_xml(cs), 6704 "system-registers.xml", 0); 6705 } 6706 6707 /* Sort alphabetically by type name, except for "any". */ 6708 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b) 6709 { 6710 ObjectClass *class_a = (ObjectClass *)a; 6711 ObjectClass *class_b = (ObjectClass *)b; 6712 const char *name_a, *name_b; 6713 6714 name_a = object_class_get_name(class_a); 6715 name_b = object_class_get_name(class_b); 6716 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) { 6717 return 1; 6718 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) { 6719 return -1; 6720 } else { 6721 return strcmp(name_a, name_b); 6722 } 6723 } 6724 6725 static void arm_cpu_list_entry(gpointer data, gpointer user_data) 6726 { 6727 ObjectClass *oc = data; 6728 const char *typename; 6729 char *name; 6730 6731 typename = object_class_get_name(oc); 6732 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6733 qemu_printf(" %s\n", name); 6734 g_free(name); 6735 } 6736 6737 void arm_cpu_list(void) 6738 { 6739 GSList *list; 6740 6741 list = object_class_get_list(TYPE_ARM_CPU, false); 6742 list = g_slist_sort(list, arm_cpu_list_compare); 6743 qemu_printf("Available CPUs:\n"); 6744 g_slist_foreach(list, arm_cpu_list_entry, NULL); 6745 g_slist_free(list); 6746 } 6747 6748 static void arm_cpu_add_definition(gpointer data, gpointer user_data) 6749 { 6750 ObjectClass *oc = data; 6751 CpuDefinitionInfoList **cpu_list = user_data; 6752 CpuDefinitionInfoList *entry; 6753 CpuDefinitionInfo *info; 6754 const char *typename; 6755 6756 typename = object_class_get_name(oc); 6757 info = g_malloc0(sizeof(*info)); 6758 info->name = g_strndup(typename, 6759 strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6760 info->q_typename = g_strdup(typename); 6761 6762 entry = g_malloc0(sizeof(*entry)); 6763 entry->value = info; 6764 entry->next = *cpu_list; 6765 *cpu_list = entry; 6766 } 6767 6768 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp) 6769 { 6770 CpuDefinitionInfoList *cpu_list = NULL; 6771 GSList *list; 6772 6773 list = object_class_get_list(TYPE_ARM_CPU, false); 6774 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list); 6775 g_slist_free(list); 6776 6777 return cpu_list; 6778 } 6779 6780 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 6781 void *opaque, int state, int secstate, 6782 int crm, int opc1, int opc2, 6783 const char *name) 6784 { 6785 /* Private utility function for define_one_arm_cp_reg_with_opaque(): 6786 * add a single reginfo struct to the hash table. 6787 */ 6788 uint32_t *key = g_new(uint32_t, 1); 6789 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo)); 6790 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0; 6791 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0; 6792 6793 r2->name = g_strdup(name); 6794 /* Reset the secure state to the specific incoming state. This is 6795 * necessary as the register may have been defined with both states. 6796 */ 6797 r2->secure = secstate; 6798 6799 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6800 /* Register is banked (using both entries in array). 6801 * Overwriting fieldoffset as the array is only used to define 6802 * banked registers but later only fieldoffset is used. 6803 */ 6804 r2->fieldoffset = r->bank_fieldoffsets[ns]; 6805 } 6806 6807 if (state == ARM_CP_STATE_AA32) { 6808 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6809 /* If the register is banked then we don't need to migrate or 6810 * reset the 32-bit instance in certain cases: 6811 * 6812 * 1) If the register has both 32-bit and 64-bit instances then we 6813 * can count on the 64-bit instance taking care of the 6814 * non-secure bank. 6815 * 2) If ARMv8 is enabled then we can count on a 64-bit version 6816 * taking care of the secure bank. This requires that separate 6817 * 32 and 64-bit definitions are provided. 6818 */ 6819 if ((r->state == ARM_CP_STATE_BOTH && ns) || 6820 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) { 6821 r2->type |= ARM_CP_ALIAS; 6822 } 6823 } else if ((secstate != r->secure) && !ns) { 6824 /* The register is not banked so we only want to allow migration of 6825 * the non-secure instance. 6826 */ 6827 r2->type |= ARM_CP_ALIAS; 6828 } 6829 6830 if (r->state == ARM_CP_STATE_BOTH) { 6831 /* We assume it is a cp15 register if the .cp field is left unset. 6832 */ 6833 if (r2->cp == 0) { 6834 r2->cp = 15; 6835 } 6836 6837 #ifdef HOST_WORDS_BIGENDIAN 6838 if (r2->fieldoffset) { 6839 r2->fieldoffset += sizeof(uint32_t); 6840 } 6841 #endif 6842 } 6843 } 6844 if (state == ARM_CP_STATE_AA64) { 6845 /* To allow abbreviation of ARMCPRegInfo 6846 * definitions, we treat cp == 0 as equivalent to 6847 * the value for "standard guest-visible sysreg". 6848 * STATE_BOTH definitions are also always "standard 6849 * sysreg" in their AArch64 view (the .cp value may 6850 * be non-zero for the benefit of the AArch32 view). 6851 */ 6852 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) { 6853 r2->cp = CP_REG_ARM64_SYSREG_CP; 6854 } 6855 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm, 6856 r2->opc0, opc1, opc2); 6857 } else { 6858 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2); 6859 } 6860 if (opaque) { 6861 r2->opaque = opaque; 6862 } 6863 /* reginfo passed to helpers is correct for the actual access, 6864 * and is never ARM_CP_STATE_BOTH: 6865 */ 6866 r2->state = state; 6867 /* Make sure reginfo passed to helpers for wildcarded regs 6868 * has the correct crm/opc1/opc2 for this reg, not CP_ANY: 6869 */ 6870 r2->crm = crm; 6871 r2->opc1 = opc1; 6872 r2->opc2 = opc2; 6873 /* By convention, for wildcarded registers only the first 6874 * entry is used for migration; the others are marked as 6875 * ALIAS so we don't try to transfer the register 6876 * multiple times. Special registers (ie NOP/WFI) are 6877 * never migratable and not even raw-accessible. 6878 */ 6879 if ((r->type & ARM_CP_SPECIAL)) { 6880 r2->type |= ARM_CP_NO_RAW; 6881 } 6882 if (((r->crm == CP_ANY) && crm != 0) || 6883 ((r->opc1 == CP_ANY) && opc1 != 0) || 6884 ((r->opc2 == CP_ANY) && opc2 != 0)) { 6885 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 6886 } 6887 6888 /* Check that raw accesses are either forbidden or handled. Note that 6889 * we can't assert this earlier because the setup of fieldoffset for 6890 * banked registers has to be done first. 6891 */ 6892 if (!(r2->type & ARM_CP_NO_RAW)) { 6893 assert(!raw_accessors_invalid(r2)); 6894 } 6895 6896 /* Overriding of an existing definition must be explicitly 6897 * requested. 6898 */ 6899 if (!(r->type & ARM_CP_OVERRIDE)) { 6900 ARMCPRegInfo *oldreg; 6901 oldreg = g_hash_table_lookup(cpu->cp_regs, key); 6902 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) { 6903 fprintf(stderr, "Register redefined: cp=%d %d bit " 6904 "crn=%d crm=%d opc1=%d opc2=%d, " 6905 "was %s, now %s\n", r2->cp, 32 + 32 * is64, 6906 r2->crn, r2->crm, r2->opc1, r2->opc2, 6907 oldreg->name, r2->name); 6908 g_assert_not_reached(); 6909 } 6910 } 6911 g_hash_table_insert(cpu->cp_regs, key, r2); 6912 } 6913 6914 6915 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 6916 const ARMCPRegInfo *r, void *opaque) 6917 { 6918 /* Define implementations of coprocessor registers. 6919 * We store these in a hashtable because typically 6920 * there are less than 150 registers in a space which 6921 * is 16*16*16*8*8 = 262144 in size. 6922 * Wildcarding is supported for the crm, opc1 and opc2 fields. 6923 * If a register is defined twice then the second definition is 6924 * used, so this can be used to define some generic registers and 6925 * then override them with implementation specific variations. 6926 * At least one of the original and the second definition should 6927 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 6928 * against accidental use. 6929 * 6930 * The state field defines whether the register is to be 6931 * visible in the AArch32 or AArch64 execution state. If the 6932 * state is set to ARM_CP_STATE_BOTH then we synthesise a 6933 * reginfo structure for the AArch32 view, which sees the lower 6934 * 32 bits of the 64 bit register. 6935 * 6936 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 6937 * be wildcarded. AArch64 registers are always considered to be 64 6938 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 6939 * the register, if any. 6940 */ 6941 int crm, opc1, opc2, state; 6942 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 6943 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 6944 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 6945 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 6946 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 6947 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 6948 /* 64 bit registers have only CRm and Opc1 fields */ 6949 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 6950 /* op0 only exists in the AArch64 encodings */ 6951 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 6952 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 6953 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 6954 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1 6955 * encodes a minimum access level for the register. We roll this 6956 * runtime check into our general permission check code, so check 6957 * here that the reginfo's specified permissions are strict enough 6958 * to encompass the generic architectural permission check. 6959 */ 6960 if (r->state != ARM_CP_STATE_AA32) { 6961 int mask = 0; 6962 switch (r->opc1) { 6963 case 0: 6964 /* min_EL EL1, but some accessible to EL0 via kernel ABI */ 6965 mask = PL0U_R | PL1_RW; 6966 break; 6967 case 1: case 2: 6968 /* min_EL EL1 */ 6969 mask = PL1_RW; 6970 break; 6971 case 3: 6972 /* min_EL EL0 */ 6973 mask = PL0_RW; 6974 break; 6975 case 4: 6976 /* min_EL EL2 */ 6977 mask = PL2_RW; 6978 break; 6979 case 5: 6980 /* unallocated encoding, so not possible */ 6981 assert(false); 6982 break; 6983 case 6: 6984 /* min_EL EL3 */ 6985 mask = PL3_RW; 6986 break; 6987 case 7: 6988 /* min_EL EL1, secure mode only (we don't check the latter) */ 6989 mask = PL1_RW; 6990 break; 6991 default: 6992 /* broken reginfo with out-of-range opc1 */ 6993 assert(false); 6994 break; 6995 } 6996 /* assert our permissions are not too lax (stricter is fine) */ 6997 assert((r->access & ~mask) == 0); 6998 } 6999 7000 /* Check that the register definition has enough info to handle 7001 * reads and writes if they are permitted. 7002 */ 7003 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) { 7004 if (r->access & PL3_R) { 7005 assert((r->fieldoffset || 7006 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 7007 r->readfn); 7008 } 7009 if (r->access & PL3_W) { 7010 assert((r->fieldoffset || 7011 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 7012 r->writefn); 7013 } 7014 } 7015 /* Bad type field probably means missing sentinel at end of reg list */ 7016 assert(cptype_valid(r->type)); 7017 for (crm = crmmin; crm <= crmmax; crm++) { 7018 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 7019 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 7020 for (state = ARM_CP_STATE_AA32; 7021 state <= ARM_CP_STATE_AA64; state++) { 7022 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 7023 continue; 7024 } 7025 if (state == ARM_CP_STATE_AA32) { 7026 /* Under AArch32 CP registers can be common 7027 * (same for secure and non-secure world) or banked. 7028 */ 7029 char *name; 7030 7031 switch (r->secure) { 7032 case ARM_CP_SECSTATE_S: 7033 case ARM_CP_SECSTATE_NS: 7034 add_cpreg_to_hashtable(cpu, r, opaque, state, 7035 r->secure, crm, opc1, opc2, 7036 r->name); 7037 break; 7038 default: 7039 name = g_strdup_printf("%s_S", r->name); 7040 add_cpreg_to_hashtable(cpu, r, opaque, state, 7041 ARM_CP_SECSTATE_S, 7042 crm, opc1, opc2, name); 7043 g_free(name); 7044 add_cpreg_to_hashtable(cpu, r, opaque, state, 7045 ARM_CP_SECSTATE_NS, 7046 crm, opc1, opc2, r->name); 7047 break; 7048 } 7049 } else { 7050 /* AArch64 registers get mapped to non-secure instance 7051 * of AArch32 */ 7052 add_cpreg_to_hashtable(cpu, r, opaque, state, 7053 ARM_CP_SECSTATE_NS, 7054 crm, opc1, opc2, r->name); 7055 } 7056 } 7057 } 7058 } 7059 } 7060 } 7061 7062 void define_arm_cp_regs_with_opaque(ARMCPU *cpu, 7063 const ARMCPRegInfo *regs, void *opaque) 7064 { 7065 /* Define a whole list of registers */ 7066 const ARMCPRegInfo *r; 7067 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 7068 define_one_arm_cp_reg_with_opaque(cpu, r, opaque); 7069 } 7070 } 7071 7072 /* 7073 * Modify ARMCPRegInfo for access from userspace. 7074 * 7075 * This is a data driven modification directed by 7076 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as 7077 * user-space cannot alter any values and dynamic values pertaining to 7078 * execution state are hidden from user space view anyway. 7079 */ 7080 void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods) 7081 { 7082 const ARMCPRegUserSpaceInfo *m; 7083 ARMCPRegInfo *r; 7084 7085 for (m = mods; m->name; m++) { 7086 GPatternSpec *pat = NULL; 7087 if (m->is_glob) { 7088 pat = g_pattern_spec_new(m->name); 7089 } 7090 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 7091 if (pat && g_pattern_match_string(pat, r->name)) { 7092 r->type = ARM_CP_CONST; 7093 r->access = PL0U_R; 7094 r->resetvalue = 0; 7095 /* continue */ 7096 } else if (strcmp(r->name, m->name) == 0) { 7097 r->type = ARM_CP_CONST; 7098 r->access = PL0U_R; 7099 r->resetvalue &= m->exported_bits; 7100 r->resetvalue |= m->fixed_bits; 7101 break; 7102 } 7103 } 7104 if (pat) { 7105 g_pattern_spec_free(pat); 7106 } 7107 } 7108 } 7109 7110 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 7111 { 7112 return g_hash_table_lookup(cpregs, &encoded_cp); 7113 } 7114 7115 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 7116 uint64_t value) 7117 { 7118 /* Helper coprocessor write function for write-ignore registers */ 7119 } 7120 7121 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 7122 { 7123 /* Helper coprocessor write function for read-as-zero registers */ 7124 return 0; 7125 } 7126 7127 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 7128 { 7129 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 7130 } 7131 7132 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 7133 { 7134 /* Return true if it is not valid for us to switch to 7135 * this CPU mode (ie all the UNPREDICTABLE cases in 7136 * the ARM ARM CPSRWriteByInstr pseudocode). 7137 */ 7138 7139 /* Changes to or from Hyp via MSR and CPS are illegal. */ 7140 if (write_type == CPSRWriteByInstr && 7141 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 7142 mode == ARM_CPU_MODE_HYP)) { 7143 return 1; 7144 } 7145 7146 switch (mode) { 7147 case ARM_CPU_MODE_USR: 7148 return 0; 7149 case ARM_CPU_MODE_SYS: 7150 case ARM_CPU_MODE_SVC: 7151 case ARM_CPU_MODE_ABT: 7152 case ARM_CPU_MODE_UND: 7153 case ARM_CPU_MODE_IRQ: 7154 case ARM_CPU_MODE_FIQ: 7155 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7 7156 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 7157 */ 7158 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 7159 * and CPS are treated as illegal mode changes. 7160 */ 7161 if (write_type == CPSRWriteByInstr && 7162 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 7163 (arm_hcr_el2_eff(env) & HCR_TGE)) { 7164 return 1; 7165 } 7166 return 0; 7167 case ARM_CPU_MODE_HYP: 7168 return !arm_feature(env, ARM_FEATURE_EL2) 7169 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env); 7170 case ARM_CPU_MODE_MON: 7171 return arm_current_el(env) < 3; 7172 default: 7173 return 1; 7174 } 7175 } 7176 7177 uint32_t cpsr_read(CPUARMState *env) 7178 { 7179 int ZF; 7180 ZF = (env->ZF == 0); 7181 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 7182 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 7183 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 7184 | ((env->condexec_bits & 0xfc) << 8) 7185 | (env->GE << 16) | (env->daif & CPSR_AIF); 7186 } 7187 7188 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 7189 CPSRWriteType write_type) 7190 { 7191 uint32_t changed_daif; 7192 7193 if (mask & CPSR_NZCV) { 7194 env->ZF = (~val) & CPSR_Z; 7195 env->NF = val; 7196 env->CF = (val >> 29) & 1; 7197 env->VF = (val << 3) & 0x80000000; 7198 } 7199 if (mask & CPSR_Q) 7200 env->QF = ((val & CPSR_Q) != 0); 7201 if (mask & CPSR_T) 7202 env->thumb = ((val & CPSR_T) != 0); 7203 if (mask & CPSR_IT_0_1) { 7204 env->condexec_bits &= ~3; 7205 env->condexec_bits |= (val >> 25) & 3; 7206 } 7207 if (mask & CPSR_IT_2_7) { 7208 env->condexec_bits &= 3; 7209 env->condexec_bits |= (val >> 8) & 0xfc; 7210 } 7211 if (mask & CPSR_GE) { 7212 env->GE = (val >> 16) & 0xf; 7213 } 7214 7215 /* In a V7 implementation that includes the security extensions but does 7216 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 7217 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 7218 * bits respectively. 7219 * 7220 * In a V8 implementation, it is permitted for privileged software to 7221 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 7222 */ 7223 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 7224 arm_feature(env, ARM_FEATURE_EL3) && 7225 !arm_feature(env, ARM_FEATURE_EL2) && 7226 !arm_is_secure(env)) { 7227 7228 changed_daif = (env->daif ^ val) & mask; 7229 7230 if (changed_daif & CPSR_A) { 7231 /* Check to see if we are allowed to change the masking of async 7232 * abort exceptions from a non-secure state. 7233 */ 7234 if (!(env->cp15.scr_el3 & SCR_AW)) { 7235 qemu_log_mask(LOG_GUEST_ERROR, 7236 "Ignoring attempt to switch CPSR_A flag from " 7237 "non-secure world with SCR.AW bit clear\n"); 7238 mask &= ~CPSR_A; 7239 } 7240 } 7241 7242 if (changed_daif & CPSR_F) { 7243 /* Check to see if we are allowed to change the masking of FIQ 7244 * exceptions from a non-secure state. 7245 */ 7246 if (!(env->cp15.scr_el3 & SCR_FW)) { 7247 qemu_log_mask(LOG_GUEST_ERROR, 7248 "Ignoring attempt to switch CPSR_F flag from " 7249 "non-secure world with SCR.FW bit clear\n"); 7250 mask &= ~CPSR_F; 7251 } 7252 7253 /* Check whether non-maskable FIQ (NMFI) support is enabled. 7254 * If this bit is set software is not allowed to mask 7255 * FIQs, but is allowed to set CPSR_F to 0. 7256 */ 7257 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 7258 (val & CPSR_F)) { 7259 qemu_log_mask(LOG_GUEST_ERROR, 7260 "Ignoring attempt to enable CPSR_F flag " 7261 "(non-maskable FIQ [NMFI] support enabled)\n"); 7262 mask &= ~CPSR_F; 7263 } 7264 } 7265 } 7266 7267 env->daif &= ~(CPSR_AIF & mask); 7268 env->daif |= val & CPSR_AIF & mask; 7269 7270 if (write_type != CPSRWriteRaw && 7271 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 7272 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 7273 /* Note that we can only get here in USR mode if this is a 7274 * gdb stub write; for this case we follow the architectural 7275 * behaviour for guest writes in USR mode of ignoring an attempt 7276 * to switch mode. (Those are caught by translate.c for writes 7277 * triggered by guest instructions.) 7278 */ 7279 mask &= ~CPSR_M; 7280 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 7281 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in 7282 * v7, and has defined behaviour in v8: 7283 * + leave CPSR.M untouched 7284 * + allow changes to the other CPSR fields 7285 * + set PSTATE.IL 7286 * For user changes via the GDB stub, we don't set PSTATE.IL, 7287 * as this would be unnecessarily harsh for a user error. 7288 */ 7289 mask &= ~CPSR_M; 7290 if (write_type != CPSRWriteByGDBStub && 7291 arm_feature(env, ARM_FEATURE_V8)) { 7292 mask |= CPSR_IL; 7293 val |= CPSR_IL; 7294 } 7295 qemu_log_mask(LOG_GUEST_ERROR, 7296 "Illegal AArch32 mode switch attempt from %s to %s\n", 7297 aarch32_mode_name(env->uncached_cpsr), 7298 aarch32_mode_name(val)); 7299 } else { 7300 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 7301 write_type == CPSRWriteExceptionReturn ? 7302 "Exception return from AArch32" : 7303 "AArch32 mode switch from", 7304 aarch32_mode_name(env->uncached_cpsr), 7305 aarch32_mode_name(val), env->regs[15]); 7306 switch_mode(env, val & CPSR_M); 7307 } 7308 } 7309 mask &= ~CACHED_CPSR_BITS; 7310 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 7311 } 7312 7313 /* Sign/zero extend */ 7314 uint32_t HELPER(sxtb16)(uint32_t x) 7315 { 7316 uint32_t res; 7317 res = (uint16_t)(int8_t)x; 7318 res |= (uint32_t)(int8_t)(x >> 16) << 16; 7319 return res; 7320 } 7321 7322 uint32_t HELPER(uxtb16)(uint32_t x) 7323 { 7324 uint32_t res; 7325 res = (uint16_t)(uint8_t)x; 7326 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 7327 return res; 7328 } 7329 7330 int32_t HELPER(sdiv)(int32_t num, int32_t den) 7331 { 7332 if (den == 0) 7333 return 0; 7334 if (num == INT_MIN && den == -1) 7335 return INT_MIN; 7336 return num / den; 7337 } 7338 7339 uint32_t HELPER(udiv)(uint32_t num, uint32_t den) 7340 { 7341 if (den == 0) 7342 return 0; 7343 return num / den; 7344 } 7345 7346 uint32_t HELPER(rbit)(uint32_t x) 7347 { 7348 return revbit32(x); 7349 } 7350 7351 #ifdef CONFIG_USER_ONLY 7352 7353 /* These should probably raise undefined insn exceptions. */ 7354 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val) 7355 { 7356 ARMCPU *cpu = arm_env_get_cpu(env); 7357 7358 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg); 7359 } 7360 7361 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) 7362 { 7363 ARMCPU *cpu = arm_env_get_cpu(env); 7364 7365 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg); 7366 return 0; 7367 } 7368 7369 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest) 7370 { 7371 /* translate.c should never generate calls here in user-only mode */ 7372 g_assert_not_reached(); 7373 } 7374 7375 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest) 7376 { 7377 /* translate.c should never generate calls here in user-only mode */ 7378 g_assert_not_reached(); 7379 } 7380 7381 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) 7382 { 7383 /* The TT instructions can be used by unprivileged code, but in 7384 * user-only emulation we don't have the MPU. 7385 * Luckily since we know we are NonSecure unprivileged (and that in 7386 * turn means that the A flag wasn't specified), all the bits in the 7387 * register must be zero: 7388 * IREGION: 0 because IRVALID is 0 7389 * IRVALID: 0 because NS 7390 * S: 0 because NS 7391 * NSRW: 0 because NS 7392 * NSR: 0 because NS 7393 * RW: 0 because unpriv and A flag not set 7394 * R: 0 because unpriv and A flag not set 7395 * SRVALID: 0 because NS 7396 * MRVALID: 0 because unpriv and A flag not set 7397 * SREGION: 0 becaus SRVALID is 0 7398 * MREGION: 0 because MRVALID is 0 7399 */ 7400 return 0; 7401 } 7402 7403 static void switch_mode(CPUARMState *env, int mode) 7404 { 7405 ARMCPU *cpu = arm_env_get_cpu(env); 7406 7407 if (mode != ARM_CPU_MODE_USR) { 7408 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 7409 } 7410 } 7411 7412 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7413 uint32_t cur_el, bool secure) 7414 { 7415 return 1; 7416 } 7417 7418 void aarch64_sync_64_to_32(CPUARMState *env) 7419 { 7420 g_assert_not_reached(); 7421 } 7422 7423 #else 7424 7425 static void switch_mode(CPUARMState *env, int mode) 7426 { 7427 int old_mode; 7428 int i; 7429 7430 old_mode = env->uncached_cpsr & CPSR_M; 7431 if (mode == old_mode) 7432 return; 7433 7434 if (old_mode == ARM_CPU_MODE_FIQ) { 7435 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7436 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 7437 } else if (mode == ARM_CPU_MODE_FIQ) { 7438 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7439 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 7440 } 7441 7442 i = bank_number(old_mode); 7443 env->banked_r13[i] = env->regs[13]; 7444 env->banked_spsr[i] = env->spsr; 7445 7446 i = bank_number(mode); 7447 env->regs[13] = env->banked_r13[i]; 7448 env->spsr = env->banked_spsr[i]; 7449 7450 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 7451 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 7452 } 7453 7454 /* Physical Interrupt Target EL Lookup Table 7455 * 7456 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 7457 * 7458 * The below multi-dimensional table is used for looking up the target 7459 * exception level given numerous condition criteria. Specifically, the 7460 * target EL is based on SCR and HCR routing controls as well as the 7461 * currently executing EL and secure state. 7462 * 7463 * Dimensions: 7464 * target_el_table[2][2][2][2][2][4] 7465 * | | | | | +--- Current EL 7466 * | | | | +------ Non-secure(0)/Secure(1) 7467 * | | | +--------- HCR mask override 7468 * | | +------------ SCR exec state control 7469 * | +--------------- SCR mask override 7470 * +------------------ 32-bit(0)/64-bit(1) EL3 7471 * 7472 * The table values are as such: 7473 * 0-3 = EL0-EL3 7474 * -1 = Cannot occur 7475 * 7476 * The ARM ARM target EL table includes entries indicating that an "exception 7477 * is not taken". The two cases where this is applicable are: 7478 * 1) An exception is taken from EL3 but the SCR does not have the exception 7479 * routed to EL3. 7480 * 2) An exception is taken from EL2 but the HCR does not have the exception 7481 * routed to EL2. 7482 * In these two cases, the below table contain a target of EL1. This value is 7483 * returned as it is expected that the consumer of the table data will check 7484 * for "target EL >= current EL" to ensure the exception is not taken. 7485 * 7486 * SCR HCR 7487 * 64 EA AMO From 7488 * BIT IRQ IMO Non-secure Secure 7489 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 7490 */ 7491 static const int8_t target_el_table[2][2][2][2][2][4] = { 7492 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7493 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 7494 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7495 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 7496 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7497 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 7498 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7499 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 7500 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 7501 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},}, 7502 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },}, 7503 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},}, 7504 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7505 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 7506 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7507 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},}, 7508 }; 7509 7510 /* 7511 * Determine the target EL for physical exceptions 7512 */ 7513 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7514 uint32_t cur_el, bool secure) 7515 { 7516 CPUARMState *env = cs->env_ptr; 7517 bool rw; 7518 bool scr; 7519 bool hcr; 7520 int target_el; 7521 /* Is the highest EL AArch64? */ 7522 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 7523 uint64_t hcr_el2; 7524 7525 if (arm_feature(env, ARM_FEATURE_EL3)) { 7526 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 7527 } else { 7528 /* Either EL2 is the highest EL (and so the EL2 register width 7529 * is given by is64); or there is no EL2 or EL3, in which case 7530 * the value of 'rw' does not affect the table lookup anyway. 7531 */ 7532 rw = is64; 7533 } 7534 7535 hcr_el2 = arm_hcr_el2_eff(env); 7536 switch (excp_idx) { 7537 case EXCP_IRQ: 7538 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 7539 hcr = hcr_el2 & HCR_IMO; 7540 break; 7541 case EXCP_FIQ: 7542 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 7543 hcr = hcr_el2 & HCR_FMO; 7544 break; 7545 default: 7546 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 7547 hcr = hcr_el2 & HCR_AMO; 7548 break; 7549 }; 7550 7551 /* Perform a table-lookup for the target EL given the current state */ 7552 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 7553 7554 assert(target_el > 0); 7555 7556 return target_el; 7557 } 7558 7559 /* 7560 * Return true if the v7M CPACR permits access to the FPU for the specified 7561 * security state and privilege level. 7562 */ 7563 static bool v7m_cpacr_pass(CPUARMState *env, bool is_secure, bool is_priv) 7564 { 7565 switch (extract32(env->v7m.cpacr[is_secure], 20, 2)) { 7566 case 0: 7567 case 2: /* UNPREDICTABLE: we treat like 0 */ 7568 return false; 7569 case 1: 7570 return is_priv; 7571 case 3: 7572 return true; 7573 default: 7574 g_assert_not_reached(); 7575 } 7576 } 7577 7578 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value, 7579 ARMMMUIdx mmu_idx, bool ignfault) 7580 { 7581 CPUState *cs = CPU(cpu); 7582 CPUARMState *env = &cpu->env; 7583 MemTxAttrs attrs = {}; 7584 MemTxResult txres; 7585 target_ulong page_size; 7586 hwaddr physaddr; 7587 int prot; 7588 ARMMMUFaultInfo fi = {}; 7589 bool secure = mmu_idx & ARM_MMU_IDX_M_S; 7590 int exc; 7591 bool exc_secure; 7592 7593 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr, 7594 &attrs, &prot, &page_size, &fi, NULL)) { 7595 /* MPU/SAU lookup failed */ 7596 if (fi.type == ARMFault_QEMU_SFault) { 7597 qemu_log_mask(CPU_LOG_INT, 7598 "...SecureFault with SFSR.AUVIOL during stacking\n"); 7599 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK; 7600 env->v7m.sfar = addr; 7601 exc = ARMV7M_EXCP_SECURE; 7602 exc_secure = false; 7603 } else { 7604 qemu_log_mask(CPU_LOG_INT, "...MemManageFault with CFSR.MSTKERR\n"); 7605 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK; 7606 exc = ARMV7M_EXCP_MEM; 7607 exc_secure = secure; 7608 } 7609 goto pend_fault; 7610 } 7611 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value, 7612 attrs, &txres); 7613 if (txres != MEMTX_OK) { 7614 /* BusFault trying to write the data */ 7615 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n"); 7616 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK; 7617 exc = ARMV7M_EXCP_BUS; 7618 exc_secure = false; 7619 goto pend_fault; 7620 } 7621 return true; 7622 7623 pend_fault: 7624 /* By pending the exception at this point we are making 7625 * the IMPDEF choice "overridden exceptions pended" (see the 7626 * MergeExcInfo() pseudocode). The other choice would be to not 7627 * pend them now and then make a choice about which to throw away 7628 * later if we have two derived exceptions. 7629 * The only case when we must not pend the exception but instead 7630 * throw it away is if we are doing the push of the callee registers 7631 * and we've already generated a derived exception. Even in this 7632 * case we will still update the fault status registers. 7633 */ 7634 if (!ignfault) { 7635 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure); 7636 } 7637 return false; 7638 } 7639 7640 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr, 7641 ARMMMUIdx mmu_idx) 7642 { 7643 CPUState *cs = CPU(cpu); 7644 CPUARMState *env = &cpu->env; 7645 MemTxAttrs attrs = {}; 7646 MemTxResult txres; 7647 target_ulong page_size; 7648 hwaddr physaddr; 7649 int prot; 7650 ARMMMUFaultInfo fi = {}; 7651 bool secure = mmu_idx & ARM_MMU_IDX_M_S; 7652 int exc; 7653 bool exc_secure; 7654 uint32_t value; 7655 7656 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr, 7657 &attrs, &prot, &page_size, &fi, NULL)) { 7658 /* MPU/SAU lookup failed */ 7659 if (fi.type == ARMFault_QEMU_SFault) { 7660 qemu_log_mask(CPU_LOG_INT, 7661 "...SecureFault with SFSR.AUVIOL during unstack\n"); 7662 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK; 7663 env->v7m.sfar = addr; 7664 exc = ARMV7M_EXCP_SECURE; 7665 exc_secure = false; 7666 } else { 7667 qemu_log_mask(CPU_LOG_INT, 7668 "...MemManageFault with CFSR.MUNSTKERR\n"); 7669 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK; 7670 exc = ARMV7M_EXCP_MEM; 7671 exc_secure = secure; 7672 } 7673 goto pend_fault; 7674 } 7675 7676 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr, 7677 attrs, &txres); 7678 if (txres != MEMTX_OK) { 7679 /* BusFault trying to read the data */ 7680 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n"); 7681 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK; 7682 exc = ARMV7M_EXCP_BUS; 7683 exc_secure = false; 7684 goto pend_fault; 7685 } 7686 7687 *dest = value; 7688 return true; 7689 7690 pend_fault: 7691 /* By pending the exception at this point we are making 7692 * the IMPDEF choice "overridden exceptions pended" (see the 7693 * MergeExcInfo() pseudocode). The other choice would be to not 7694 * pend them now and then make a choice about which to throw away 7695 * later if we have two derived exceptions. 7696 */ 7697 armv7m_nvic_set_pending(env->nvic, exc, exc_secure); 7698 return false; 7699 } 7700 7701 /* Write to v7M CONTROL.SPSEL bit for the specified security bank. 7702 * This may change the current stack pointer between Main and Process 7703 * stack pointers if it is done for the CONTROL register for the current 7704 * security state. 7705 */ 7706 static void write_v7m_control_spsel_for_secstate(CPUARMState *env, 7707 bool new_spsel, 7708 bool secstate) 7709 { 7710 bool old_is_psp = v7m_using_psp(env); 7711 7712 env->v7m.control[secstate] = 7713 deposit32(env->v7m.control[secstate], 7714 R_V7M_CONTROL_SPSEL_SHIFT, 7715 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel); 7716 7717 if (secstate == env->v7m.secure) { 7718 bool new_is_psp = v7m_using_psp(env); 7719 uint32_t tmp; 7720 7721 if (old_is_psp != new_is_psp) { 7722 tmp = env->v7m.other_sp; 7723 env->v7m.other_sp = env->regs[13]; 7724 env->regs[13] = tmp; 7725 } 7726 } 7727 } 7728 7729 /* Write to v7M CONTROL.SPSEL bit. This may change the current 7730 * stack pointer between Main and Process stack pointers. 7731 */ 7732 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel) 7733 { 7734 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure); 7735 } 7736 7737 void write_v7m_exception(CPUARMState *env, uint32_t new_exc) 7738 { 7739 /* Write a new value to v7m.exception, thus transitioning into or out 7740 * of Handler mode; this may result in a change of active stack pointer. 7741 */ 7742 bool new_is_psp, old_is_psp = v7m_using_psp(env); 7743 uint32_t tmp; 7744 7745 env->v7m.exception = new_exc; 7746 7747 new_is_psp = v7m_using_psp(env); 7748 7749 if (old_is_psp != new_is_psp) { 7750 tmp = env->v7m.other_sp; 7751 env->v7m.other_sp = env->regs[13]; 7752 env->regs[13] = tmp; 7753 } 7754 } 7755 7756 /* Switch M profile security state between NS and S */ 7757 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate) 7758 { 7759 uint32_t new_ss_msp, new_ss_psp; 7760 7761 if (env->v7m.secure == new_secstate) { 7762 return; 7763 } 7764 7765 /* All the banked state is accessed by looking at env->v7m.secure 7766 * except for the stack pointer; rearrange the SP appropriately. 7767 */ 7768 new_ss_msp = env->v7m.other_ss_msp; 7769 new_ss_psp = env->v7m.other_ss_psp; 7770 7771 if (v7m_using_psp(env)) { 7772 env->v7m.other_ss_psp = env->regs[13]; 7773 env->v7m.other_ss_msp = env->v7m.other_sp; 7774 } else { 7775 env->v7m.other_ss_msp = env->regs[13]; 7776 env->v7m.other_ss_psp = env->v7m.other_sp; 7777 } 7778 7779 env->v7m.secure = new_secstate; 7780 7781 if (v7m_using_psp(env)) { 7782 env->regs[13] = new_ss_psp; 7783 env->v7m.other_sp = new_ss_msp; 7784 } else { 7785 env->regs[13] = new_ss_msp; 7786 env->v7m.other_sp = new_ss_psp; 7787 } 7788 } 7789 7790 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest) 7791 { 7792 /* Handle v7M BXNS: 7793 * - if the return value is a magic value, do exception return (like BX) 7794 * - otherwise bit 0 of the return value is the target security state 7795 */ 7796 uint32_t min_magic; 7797 7798 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7799 /* Covers FNC_RETURN and EXC_RETURN magic */ 7800 min_magic = FNC_RETURN_MIN_MAGIC; 7801 } else { 7802 /* EXC_RETURN magic only */ 7803 min_magic = EXC_RETURN_MIN_MAGIC; 7804 } 7805 7806 if (dest >= min_magic) { 7807 /* This is an exception return magic value; put it where 7808 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT. 7809 * Note that if we ever add gen_ss_advance() singlestep support to 7810 * M profile this should count as an "instruction execution complete" 7811 * event (compare gen_bx_excret_final_code()). 7812 */ 7813 env->regs[15] = dest & ~1; 7814 env->thumb = dest & 1; 7815 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT); 7816 /* notreached */ 7817 } 7818 7819 /* translate.c should have made BXNS UNDEF unless we're secure */ 7820 assert(env->v7m.secure); 7821 7822 if (!(dest & 1)) { 7823 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 7824 } 7825 switch_v7m_security_state(env, dest & 1); 7826 env->thumb = 1; 7827 env->regs[15] = dest & ~1; 7828 } 7829 7830 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest) 7831 { 7832 /* Handle v7M BLXNS: 7833 * - bit 0 of the destination address is the target security state 7834 */ 7835 7836 /* At this point regs[15] is the address just after the BLXNS */ 7837 uint32_t nextinst = env->regs[15] | 1; 7838 uint32_t sp = env->regs[13] - 8; 7839 uint32_t saved_psr; 7840 7841 /* translate.c will have made BLXNS UNDEF unless we're secure */ 7842 assert(env->v7m.secure); 7843 7844 if (dest & 1) { 7845 /* target is Secure, so this is just a normal BLX, 7846 * except that the low bit doesn't indicate Thumb/not. 7847 */ 7848 env->regs[14] = nextinst; 7849 env->thumb = 1; 7850 env->regs[15] = dest & ~1; 7851 return; 7852 } 7853 7854 /* Target is non-secure: first push a stack frame */ 7855 if (!QEMU_IS_ALIGNED(sp, 8)) { 7856 qemu_log_mask(LOG_GUEST_ERROR, 7857 "BLXNS with misaligned SP is UNPREDICTABLE\n"); 7858 } 7859 7860 if (sp < v7m_sp_limit(env)) { 7861 raise_exception(env, EXCP_STKOF, 0, 1); 7862 } 7863 7864 saved_psr = env->v7m.exception; 7865 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) { 7866 saved_psr |= XPSR_SFPA; 7867 } 7868 7869 /* Note that these stores can throw exceptions on MPU faults */ 7870 cpu_stl_data(env, sp, nextinst); 7871 cpu_stl_data(env, sp + 4, saved_psr); 7872 7873 env->regs[13] = sp; 7874 env->regs[14] = 0xfeffffff; 7875 if (arm_v7m_is_handler_mode(env)) { 7876 /* Write a dummy value to IPSR, to avoid leaking the current secure 7877 * exception number to non-secure code. This is guaranteed not 7878 * to cause write_v7m_exception() to actually change stacks. 7879 */ 7880 write_v7m_exception(env, 1); 7881 } 7882 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 7883 switch_v7m_security_state(env, 0); 7884 env->thumb = 1; 7885 env->regs[15] = dest; 7886 } 7887 7888 static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode, 7889 bool spsel) 7890 { 7891 /* Return a pointer to the location where we currently store the 7892 * stack pointer for the requested security state and thread mode. 7893 * This pointer will become invalid if the CPU state is updated 7894 * such that the stack pointers are switched around (eg changing 7895 * the SPSEL control bit). 7896 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode(). 7897 * Unlike that pseudocode, we require the caller to pass us in the 7898 * SPSEL control bit value; this is because we also use this 7899 * function in handling of pushing of the callee-saves registers 7900 * part of the v8M stack frame (pseudocode PushCalleeStack()), 7901 * and in the tailchain codepath the SPSEL bit comes from the exception 7902 * return magic LR value from the previous exception. The pseudocode 7903 * opencodes the stack-selection in PushCalleeStack(), but we prefer 7904 * to make this utility function generic enough to do the job. 7905 */ 7906 bool want_psp = threadmode && spsel; 7907 7908 if (secure == env->v7m.secure) { 7909 if (want_psp == v7m_using_psp(env)) { 7910 return &env->regs[13]; 7911 } else { 7912 return &env->v7m.other_sp; 7913 } 7914 } else { 7915 if (want_psp) { 7916 return &env->v7m.other_ss_psp; 7917 } else { 7918 return &env->v7m.other_ss_msp; 7919 } 7920 } 7921 } 7922 7923 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure, 7924 uint32_t *pvec) 7925 { 7926 CPUState *cs = CPU(cpu); 7927 CPUARMState *env = &cpu->env; 7928 MemTxResult result; 7929 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4; 7930 uint32_t vector_entry; 7931 MemTxAttrs attrs = {}; 7932 ARMMMUIdx mmu_idx; 7933 bool exc_secure; 7934 7935 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true); 7936 7937 /* We don't do a get_phys_addr() here because the rules for vector 7938 * loads are special: they always use the default memory map, and 7939 * the default memory map permits reads from all addresses. 7940 * Since there's no easy way to pass through to pmsav8_mpu_lookup() 7941 * that we want this special case which would always say "yes", 7942 * we just do the SAU lookup here followed by a direct physical load. 7943 */ 7944 attrs.secure = targets_secure; 7945 attrs.user = false; 7946 7947 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7948 V8M_SAttributes sattrs = {}; 7949 7950 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs); 7951 if (sattrs.ns) { 7952 attrs.secure = false; 7953 } else if (!targets_secure) { 7954 /* NS access to S memory */ 7955 goto load_fail; 7956 } 7957 } 7958 7959 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr, 7960 attrs, &result); 7961 if (result != MEMTX_OK) { 7962 goto load_fail; 7963 } 7964 *pvec = vector_entry; 7965 return true; 7966 7967 load_fail: 7968 /* All vector table fetch fails are reported as HardFault, with 7969 * HFSR.VECTTBL and .FORCED set. (FORCED is set because 7970 * technically the underlying exception is a MemManage or BusFault 7971 * that is escalated to HardFault.) This is a terminal exception, 7972 * so we will either take the HardFault immediately or else enter 7973 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()). 7974 */ 7975 exc_secure = targets_secure || 7976 !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK); 7977 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK; 7978 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure); 7979 return false; 7980 } 7981 7982 static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr) 7983 { 7984 /* 7985 * Return the integrity signature value for the callee-saves 7986 * stack frame section. @lr is the exception return payload/LR value 7987 * whose FType bit forms bit 0 of the signature if FP is present. 7988 */ 7989 uint32_t sig = 0xfefa125a; 7990 7991 if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) { 7992 sig |= 1; 7993 } 7994 return sig; 7995 } 7996 7997 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain, 7998 bool ignore_faults) 7999 { 8000 /* For v8M, push the callee-saves register part of the stack frame. 8001 * Compare the v8M pseudocode PushCalleeStack(). 8002 * In the tailchaining case this may not be the current stack. 8003 */ 8004 CPUARMState *env = &cpu->env; 8005 uint32_t *frame_sp_p; 8006 uint32_t frameptr; 8007 ARMMMUIdx mmu_idx; 8008 bool stacked_ok; 8009 uint32_t limit; 8010 bool want_psp; 8011 uint32_t sig; 8012 8013 if (dotailchain) { 8014 bool mode = lr & R_V7M_EXCRET_MODE_MASK; 8015 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) || 8016 !mode; 8017 8018 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv); 8019 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode, 8020 lr & R_V7M_EXCRET_SPSEL_MASK); 8021 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK); 8022 if (want_psp) { 8023 limit = env->v7m.psplim[M_REG_S]; 8024 } else { 8025 limit = env->v7m.msplim[M_REG_S]; 8026 } 8027 } else { 8028 mmu_idx = arm_mmu_idx(env); 8029 frame_sp_p = &env->regs[13]; 8030 limit = v7m_sp_limit(env); 8031 } 8032 8033 frameptr = *frame_sp_p - 0x28; 8034 if (frameptr < limit) { 8035 /* 8036 * Stack limit failure: set SP to the limit value, and generate 8037 * STKOF UsageFault. Stack pushes below the limit must not be 8038 * performed. It is IMPDEF whether pushes above the limit are 8039 * performed; we choose not to. 8040 */ 8041 qemu_log_mask(CPU_LOG_INT, 8042 "...STKOF during callee-saves register stacking\n"); 8043 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 8044 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8045 env->v7m.secure); 8046 *frame_sp_p = limit; 8047 return true; 8048 } 8049 8050 /* Write as much of the stack frame as we can. A write failure may 8051 * cause us to pend a derived exception. 8052 */ 8053 sig = v7m_integrity_sig(env, lr); 8054 stacked_ok = 8055 v7m_stack_write(cpu, frameptr, sig, mmu_idx, ignore_faults) && 8056 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, 8057 ignore_faults) && 8058 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, 8059 ignore_faults) && 8060 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, 8061 ignore_faults) && 8062 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, 8063 ignore_faults) && 8064 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, 8065 ignore_faults) && 8066 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, 8067 ignore_faults) && 8068 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, 8069 ignore_faults) && 8070 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, 8071 ignore_faults); 8072 8073 /* Update SP regardless of whether any of the stack accesses failed. */ 8074 *frame_sp_p = frameptr; 8075 8076 return !stacked_ok; 8077 } 8078 8079 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain, 8080 bool ignore_stackfaults) 8081 { 8082 /* Do the "take the exception" parts of exception entry, 8083 * but not the pushing of state to the stack. This is 8084 * similar to the pseudocode ExceptionTaken() function. 8085 */ 8086 CPUARMState *env = &cpu->env; 8087 uint32_t addr; 8088 bool targets_secure; 8089 int exc; 8090 bool push_failed = false; 8091 8092 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure); 8093 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n", 8094 targets_secure ? "secure" : "nonsecure", exc); 8095 8096 if (dotailchain) { 8097 /* Sanitize LR FType and PREFIX bits */ 8098 if (!arm_feature(env, ARM_FEATURE_VFP)) { 8099 lr |= R_V7M_EXCRET_FTYPE_MASK; 8100 } 8101 lr = deposit32(lr, 24, 8, 0xff); 8102 } 8103 8104 if (arm_feature(env, ARM_FEATURE_V8)) { 8105 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 8106 (lr & R_V7M_EXCRET_S_MASK)) { 8107 /* The background code (the owner of the registers in the 8108 * exception frame) is Secure. This means it may either already 8109 * have or now needs to push callee-saves registers. 8110 */ 8111 if (targets_secure) { 8112 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) { 8113 /* We took an exception from Secure to NonSecure 8114 * (which means the callee-saved registers got stacked) 8115 * and are now tailchaining to a Secure exception. 8116 * Clear DCRS so eventual return from this Secure 8117 * exception unstacks the callee-saved registers. 8118 */ 8119 lr &= ~R_V7M_EXCRET_DCRS_MASK; 8120 } 8121 } else { 8122 /* We're going to a non-secure exception; push the 8123 * callee-saves registers to the stack now, if they're 8124 * not already saved. 8125 */ 8126 if (lr & R_V7M_EXCRET_DCRS_MASK && 8127 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) { 8128 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain, 8129 ignore_stackfaults); 8130 } 8131 lr |= R_V7M_EXCRET_DCRS_MASK; 8132 } 8133 } 8134 8135 lr &= ~R_V7M_EXCRET_ES_MASK; 8136 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8137 lr |= R_V7M_EXCRET_ES_MASK; 8138 } 8139 lr &= ~R_V7M_EXCRET_SPSEL_MASK; 8140 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) { 8141 lr |= R_V7M_EXCRET_SPSEL_MASK; 8142 } 8143 8144 /* Clear registers if necessary to prevent non-secure exception 8145 * code being able to see register values from secure code. 8146 * Where register values become architecturally UNKNOWN we leave 8147 * them with their previous values. 8148 */ 8149 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8150 if (!targets_secure) { 8151 /* Always clear the caller-saved registers (they have been 8152 * pushed to the stack earlier in v7m_push_stack()). 8153 * Clear callee-saved registers if the background code is 8154 * Secure (in which case these regs were saved in 8155 * v7m_push_callee_stack()). 8156 */ 8157 int i; 8158 8159 for (i = 0; i < 13; i++) { 8160 /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */ 8161 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) { 8162 env->regs[i] = 0; 8163 } 8164 } 8165 /* Clear EAPSR */ 8166 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT); 8167 } 8168 } 8169 } 8170 8171 if (push_failed && !ignore_stackfaults) { 8172 /* Derived exception on callee-saves register stacking: 8173 * we might now want to take a different exception which 8174 * targets a different security state, so try again from the top. 8175 */ 8176 qemu_log_mask(CPU_LOG_INT, 8177 "...derived exception on callee-saves register stacking"); 8178 v7m_exception_taken(cpu, lr, true, true); 8179 return; 8180 } 8181 8182 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) { 8183 /* Vector load failed: derived exception */ 8184 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load"); 8185 v7m_exception_taken(cpu, lr, true, true); 8186 return; 8187 } 8188 8189 /* Now we've done everything that might cause a derived exception 8190 * we can go ahead and activate whichever exception we're going to 8191 * take (which might now be the derived exception). 8192 */ 8193 armv7m_nvic_acknowledge_irq(env->nvic); 8194 8195 /* Switch to target security state -- must do this before writing SPSEL */ 8196 switch_v7m_security_state(env, targets_secure); 8197 write_v7m_control_spsel(env, 0); 8198 arm_clear_exclusive(env); 8199 /* Clear SFPA and FPCA (has no effect if no FPU) */ 8200 env->v7m.control[M_REG_S] &= 8201 ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK); 8202 /* Clear IT bits */ 8203 env->condexec_bits = 0; 8204 env->regs[14] = lr; 8205 env->regs[15] = addr & 0xfffffffe; 8206 env->thumb = addr & 1; 8207 } 8208 8209 static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr, 8210 bool apply_splim) 8211 { 8212 /* 8213 * Like the pseudocode UpdateFPCCR: save state in FPCAR and FPCCR 8214 * that we will need later in order to do lazy FP reg stacking. 8215 */ 8216 bool is_secure = env->v7m.secure; 8217 void *nvic = env->nvic; 8218 /* 8219 * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits 8220 * are banked and we want to update the bit in the bank for the 8221 * current security state; and in one case we want to specifically 8222 * update the NS banked version of a bit even if we are secure. 8223 */ 8224 uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S]; 8225 uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS]; 8226 uint32_t *fpccr = &env->v7m.fpccr[is_secure]; 8227 bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy; 8228 8229 env->v7m.fpcar[is_secure] = frameptr & ~0x7; 8230 8231 if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) { 8232 bool splimviol; 8233 uint32_t splim = v7m_sp_limit(env); 8234 bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) && 8235 (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK); 8236 8237 splimviol = !ign && frameptr < splim; 8238 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol); 8239 } 8240 8241 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1); 8242 8243 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure); 8244 8245 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0); 8246 8247 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD, 8248 !arm_v7m_is_handler_mode(env)); 8249 8250 hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false); 8251 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy); 8252 8253 bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false); 8254 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy); 8255 8256 mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure); 8257 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy); 8258 8259 ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false); 8260 *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy); 8261 8262 monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false); 8263 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy); 8264 8265 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8266 s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true); 8267 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy); 8268 8269 sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false); 8270 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy); 8271 } 8272 } 8273 8274 static bool v7m_push_stack(ARMCPU *cpu) 8275 { 8276 /* Do the "set up stack frame" part of exception entry, 8277 * similar to pseudocode PushStack(). 8278 * Return true if we generate a derived exception (and so 8279 * should ignore further stack faults trying to process 8280 * that derived exception.) 8281 */ 8282 bool stacked_ok = true, limitviol = false; 8283 CPUARMState *env = &cpu->env; 8284 uint32_t xpsr = xpsr_read(env); 8285 uint32_t frameptr = env->regs[13]; 8286 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 8287 uint32_t framesize; 8288 bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1); 8289 8290 if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) && 8291 (env->v7m.secure || nsacr_cp10)) { 8292 if (env->v7m.secure && 8293 env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) { 8294 framesize = 0xa8; 8295 } else { 8296 framesize = 0x68; 8297 } 8298 } else { 8299 framesize = 0x20; 8300 } 8301 8302 /* Align stack pointer if the guest wants that */ 8303 if ((frameptr & 4) && 8304 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) { 8305 frameptr -= 4; 8306 xpsr |= XPSR_SPREALIGN; 8307 } 8308 8309 xpsr &= ~XPSR_SFPA; 8310 if (env->v7m.secure && 8311 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) { 8312 xpsr |= XPSR_SFPA; 8313 } 8314 8315 frameptr -= framesize; 8316 8317 if (arm_feature(env, ARM_FEATURE_V8)) { 8318 uint32_t limit = v7m_sp_limit(env); 8319 8320 if (frameptr < limit) { 8321 /* 8322 * Stack limit failure: set SP to the limit value, and generate 8323 * STKOF UsageFault. Stack pushes below the limit must not be 8324 * performed. It is IMPDEF whether pushes above the limit are 8325 * performed; we choose not to. 8326 */ 8327 qemu_log_mask(CPU_LOG_INT, 8328 "...STKOF during stacking\n"); 8329 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 8330 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8331 env->v7m.secure); 8332 env->regs[13] = limit; 8333 /* 8334 * We won't try to perform any further memory accesses but 8335 * we must continue through the following code to check for 8336 * permission faults during FPU state preservation, and we 8337 * must update FPCCR if lazy stacking is enabled. 8338 */ 8339 limitviol = true; 8340 stacked_ok = false; 8341 } 8342 } 8343 8344 /* Write as much of the stack frame as we can. If we fail a stack 8345 * write this will result in a derived exception being pended 8346 * (which may be taken in preference to the one we started with 8347 * if it has higher priority). 8348 */ 8349 stacked_ok = stacked_ok && 8350 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, false) && 8351 v7m_stack_write(cpu, frameptr + 4, env->regs[1], mmu_idx, false) && 8352 v7m_stack_write(cpu, frameptr + 8, env->regs[2], mmu_idx, false) && 8353 v7m_stack_write(cpu, frameptr + 12, env->regs[3], mmu_idx, false) && 8354 v7m_stack_write(cpu, frameptr + 16, env->regs[12], mmu_idx, false) && 8355 v7m_stack_write(cpu, frameptr + 20, env->regs[14], mmu_idx, false) && 8356 v7m_stack_write(cpu, frameptr + 24, env->regs[15], mmu_idx, false) && 8357 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, false); 8358 8359 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) { 8360 /* FPU is active, try to save its registers */ 8361 bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 8362 bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK; 8363 8364 if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8365 qemu_log_mask(CPU_LOG_INT, 8366 "...SecureFault because LSPACT and FPCA both set\n"); 8367 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; 8368 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8369 } else if (!env->v7m.secure && !nsacr_cp10) { 8370 qemu_log_mask(CPU_LOG_INT, 8371 "...Secure UsageFault with CFSR.NOCP because " 8372 "NSACR.CP10 prevents stacking FP regs\n"); 8373 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S); 8374 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK; 8375 } else { 8376 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) { 8377 /* Lazy stacking disabled, save registers now */ 8378 int i; 8379 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure, 8380 arm_current_el(env) != 0); 8381 8382 if (stacked_ok && !cpacr_pass) { 8383 /* 8384 * Take UsageFault if CPACR forbids access. The pseudocode 8385 * here does a full CheckCPEnabled() but we know the NSACR 8386 * check can never fail as we have already handled that. 8387 */ 8388 qemu_log_mask(CPU_LOG_INT, 8389 "...UsageFault with CFSR.NOCP because " 8390 "CPACR.CP10 prevents stacking FP regs\n"); 8391 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8392 env->v7m.secure); 8393 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK; 8394 stacked_ok = false; 8395 } 8396 8397 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) { 8398 uint64_t dn = *aa32_vfp_dreg(env, i / 2); 8399 uint32_t faddr = frameptr + 0x20 + 4 * i; 8400 uint32_t slo = extract64(dn, 0, 32); 8401 uint32_t shi = extract64(dn, 32, 32); 8402 8403 if (i >= 16) { 8404 faddr += 8; /* skip the slot for the FPSCR */ 8405 } 8406 stacked_ok = stacked_ok && 8407 v7m_stack_write(cpu, faddr, slo, mmu_idx, false) && 8408 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, false); 8409 } 8410 stacked_ok = stacked_ok && 8411 v7m_stack_write(cpu, frameptr + 0x60, 8412 vfp_get_fpscr(env), mmu_idx, false); 8413 if (cpacr_pass) { 8414 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) { 8415 *aa32_vfp_dreg(env, i / 2) = 0; 8416 } 8417 vfp_set_fpscr(env, 0); 8418 } 8419 } else { 8420 /* Lazy stacking enabled, save necessary info to stack later */ 8421 v7m_update_fpccr(env, frameptr + 0x20, true); 8422 } 8423 } 8424 } 8425 8426 /* 8427 * If we broke a stack limit then SP was already updated earlier; 8428 * otherwise we update SP regardless of whether any of the stack 8429 * accesses failed or we took some other kind of fault. 8430 */ 8431 if (!limitviol) { 8432 env->regs[13] = frameptr; 8433 } 8434 8435 return !stacked_ok; 8436 } 8437 8438 static void do_v7m_exception_exit(ARMCPU *cpu) 8439 { 8440 CPUARMState *env = &cpu->env; 8441 uint32_t excret; 8442 uint32_t xpsr; 8443 bool ufault = false; 8444 bool sfault = false; 8445 bool return_to_sp_process; 8446 bool return_to_handler; 8447 bool rettobase = false; 8448 bool exc_secure = false; 8449 bool return_to_secure; 8450 bool ftype; 8451 bool restore_s16_s31; 8452 8453 /* If we're not in Handler mode then jumps to magic exception-exit 8454 * addresses don't have magic behaviour. However for the v8M 8455 * security extensions the magic secure-function-return has to 8456 * work in thread mode too, so to avoid doing an extra check in 8457 * the generated code we allow exception-exit magic to also cause the 8458 * internal exception and bring us here in thread mode. Correct code 8459 * will never try to do this (the following insn fetch will always 8460 * fault) so we the overhead of having taken an unnecessary exception 8461 * doesn't matter. 8462 */ 8463 if (!arm_v7m_is_handler_mode(env)) { 8464 return; 8465 } 8466 8467 /* In the spec pseudocode ExceptionReturn() is called directly 8468 * from BXWritePC() and gets the full target PC value including 8469 * bit zero. In QEMU's implementation we treat it as a normal 8470 * jump-to-register (which is then caught later on), and so split 8471 * the target value up between env->regs[15] and env->thumb in 8472 * gen_bx(). Reconstitute it. 8473 */ 8474 excret = env->regs[15]; 8475 if (env->thumb) { 8476 excret |= 1; 8477 } 8478 8479 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32 8480 " previous exception %d\n", 8481 excret, env->v7m.exception); 8482 8483 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) { 8484 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception " 8485 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", 8486 excret); 8487 } 8488 8489 ftype = excret & R_V7M_EXCRET_FTYPE_MASK; 8490 8491 if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) { 8492 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception " 8493 "exit PC value 0x%" PRIx32 " is UNPREDICTABLE " 8494 "if FPU not present\n", 8495 excret); 8496 ftype = true; 8497 } 8498 8499 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8500 /* EXC_RETURN.ES validation check (R_SMFL). We must do this before 8501 * we pick which FAULTMASK to clear. 8502 */ 8503 if (!env->v7m.secure && 8504 ((excret & R_V7M_EXCRET_ES_MASK) || 8505 !(excret & R_V7M_EXCRET_DCRS_MASK))) { 8506 sfault = 1; 8507 /* For all other purposes, treat ES as 0 (R_HXSR) */ 8508 excret &= ~R_V7M_EXCRET_ES_MASK; 8509 } 8510 exc_secure = excret & R_V7M_EXCRET_ES_MASK; 8511 } 8512 8513 if (env->v7m.exception != ARMV7M_EXCP_NMI) { 8514 /* Auto-clear FAULTMASK on return from other than NMI. 8515 * If the security extension is implemented then this only 8516 * happens if the raw execution priority is >= 0; the 8517 * value of the ES bit in the exception return value indicates 8518 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.) 8519 */ 8520 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8521 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) { 8522 env->v7m.faultmask[exc_secure] = 0; 8523 } 8524 } else { 8525 env->v7m.faultmask[M_REG_NS] = 0; 8526 } 8527 } 8528 8529 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception, 8530 exc_secure)) { 8531 case -1: 8532 /* attempt to exit an exception that isn't active */ 8533 ufault = true; 8534 break; 8535 case 0: 8536 /* still an irq active now */ 8537 break; 8538 case 1: 8539 /* we returned to base exception level, no nesting. 8540 * (In the pseudocode this is written using "NestedActivation != 1" 8541 * where we have 'rettobase == false'.) 8542 */ 8543 rettobase = true; 8544 break; 8545 default: 8546 g_assert_not_reached(); 8547 } 8548 8549 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK); 8550 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK; 8551 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) && 8552 (excret & R_V7M_EXCRET_S_MASK); 8553 8554 if (arm_feature(env, ARM_FEATURE_V8)) { 8555 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8556 /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP); 8557 * we choose to take the UsageFault. 8558 */ 8559 if ((excret & R_V7M_EXCRET_S_MASK) || 8560 (excret & R_V7M_EXCRET_ES_MASK) || 8561 !(excret & R_V7M_EXCRET_DCRS_MASK)) { 8562 ufault = true; 8563 } 8564 } 8565 if (excret & R_V7M_EXCRET_RES0_MASK) { 8566 ufault = true; 8567 } 8568 } else { 8569 /* For v7M we only recognize certain combinations of the low bits */ 8570 switch (excret & 0xf) { 8571 case 1: /* Return to Handler */ 8572 break; 8573 case 13: /* Return to Thread using Process stack */ 8574 case 9: /* Return to Thread using Main stack */ 8575 /* We only need to check NONBASETHRDENA for v7M, because in 8576 * v8M this bit does not exist (it is RES1). 8577 */ 8578 if (!rettobase && 8579 !(env->v7m.ccr[env->v7m.secure] & 8580 R_V7M_CCR_NONBASETHRDENA_MASK)) { 8581 ufault = true; 8582 } 8583 break; 8584 default: 8585 ufault = true; 8586 } 8587 } 8588 8589 /* 8590 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in 8591 * Handler mode (and will be until we write the new XPSR.Interrupt 8592 * field) this does not switch around the current stack pointer. 8593 * We must do this before we do any kind of tailchaining, including 8594 * for the derived exceptions on integrity check failures, or we will 8595 * give the guest an incorrect EXCRET.SPSEL value on exception entry. 8596 */ 8597 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure); 8598 8599 /* 8600 * Clear scratch FP values left in caller saved registers; this 8601 * must happen before any kind of tail chaining. 8602 */ 8603 if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) && 8604 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) { 8605 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) { 8606 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; 8607 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8608 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8609 "stackframe: error during lazy state deactivation\n"); 8610 v7m_exception_taken(cpu, excret, true, false); 8611 return; 8612 } else { 8613 /* Clear s0..s15 and FPSCR */ 8614 int i; 8615 8616 for (i = 0; i < 16; i += 2) { 8617 *aa32_vfp_dreg(env, i / 2) = 0; 8618 } 8619 vfp_set_fpscr(env, 0); 8620 } 8621 } 8622 8623 if (sfault) { 8624 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK; 8625 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8626 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8627 "stackframe: failed EXC_RETURN.ES validity check\n"); 8628 v7m_exception_taken(cpu, excret, true, false); 8629 return; 8630 } 8631 8632 if (ufault) { 8633 /* Bad exception return: instead of popping the exception 8634 * stack, directly take a usage fault on the current stack. 8635 */ 8636 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8637 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8638 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " 8639 "stackframe: failed exception return integrity check\n"); 8640 v7m_exception_taken(cpu, excret, true, false); 8641 return; 8642 } 8643 8644 /* 8645 * Tailchaining: if there is currently a pending exception that 8646 * is high enough priority to preempt execution at the level we're 8647 * about to return to, then just directly take that exception now, 8648 * avoiding an unstack-and-then-stack. Note that now we have 8649 * deactivated the previous exception by calling armv7m_nvic_complete_irq() 8650 * our current execution priority is already the execution priority we are 8651 * returning to -- none of the state we would unstack or set based on 8652 * the EXCRET value affects it. 8653 */ 8654 if (armv7m_nvic_can_take_pending_exception(env->nvic)) { 8655 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n"); 8656 v7m_exception_taken(cpu, excret, true, false); 8657 return; 8658 } 8659 8660 switch_v7m_security_state(env, return_to_secure); 8661 8662 { 8663 /* The stack pointer we should be reading the exception frame from 8664 * depends on bits in the magic exception return type value (and 8665 * for v8M isn't necessarily the stack pointer we will eventually 8666 * end up resuming execution with). Get a pointer to the location 8667 * in the CPU state struct where the SP we need is currently being 8668 * stored; we will use and modify it in place. 8669 * We use this limited C variable scope so we don't accidentally 8670 * use 'frame_sp_p' after we do something that makes it invalid. 8671 */ 8672 uint32_t *frame_sp_p = get_v7m_sp_ptr(env, 8673 return_to_secure, 8674 !return_to_handler, 8675 return_to_sp_process); 8676 uint32_t frameptr = *frame_sp_p; 8677 bool pop_ok = true; 8678 ARMMMUIdx mmu_idx; 8679 bool return_to_priv = return_to_handler || 8680 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK); 8681 8682 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure, 8683 return_to_priv); 8684 8685 if (!QEMU_IS_ALIGNED(frameptr, 8) && 8686 arm_feature(env, ARM_FEATURE_V8)) { 8687 qemu_log_mask(LOG_GUEST_ERROR, 8688 "M profile exception return with non-8-aligned SP " 8689 "for destination state is UNPREDICTABLE\n"); 8690 } 8691 8692 /* Do we need to pop callee-saved registers? */ 8693 if (return_to_secure && 8694 ((excret & R_V7M_EXCRET_ES_MASK) == 0 || 8695 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) { 8696 uint32_t actual_sig; 8697 8698 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx); 8699 8700 if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) { 8701 /* Take a SecureFault on the current stack */ 8702 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK; 8703 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8704 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8705 "stackframe: failed exception return integrity " 8706 "signature check\n"); 8707 v7m_exception_taken(cpu, excret, true, false); 8708 return; 8709 } 8710 8711 pop_ok = pop_ok && 8712 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) && 8713 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) && 8714 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) && 8715 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) && 8716 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) && 8717 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) && 8718 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) && 8719 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx); 8720 8721 frameptr += 0x28; 8722 } 8723 8724 /* Pop registers */ 8725 pop_ok = pop_ok && 8726 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) && 8727 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) && 8728 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) && 8729 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) && 8730 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) && 8731 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) && 8732 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) && 8733 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx); 8734 8735 if (!pop_ok) { 8736 /* v7m_stack_read() pended a fault, so take it (as a tail 8737 * chained exception on the same stack frame) 8738 */ 8739 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n"); 8740 v7m_exception_taken(cpu, excret, true, false); 8741 return; 8742 } 8743 8744 /* Returning from an exception with a PC with bit 0 set is defined 8745 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified 8746 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore 8747 * the lsbit, and there are several RTOSes out there which incorrectly 8748 * assume the r15 in the stack frame should be a Thumb-style "lsbit 8749 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but 8750 * complain about the badly behaved guest. 8751 */ 8752 if (env->regs[15] & 1) { 8753 env->regs[15] &= ~1U; 8754 if (!arm_feature(env, ARM_FEATURE_V8)) { 8755 qemu_log_mask(LOG_GUEST_ERROR, 8756 "M profile return from interrupt with misaligned " 8757 "PC is UNPREDICTABLE on v7M\n"); 8758 } 8759 } 8760 8761 if (arm_feature(env, ARM_FEATURE_V8)) { 8762 /* For v8M we have to check whether the xPSR exception field 8763 * matches the EXCRET value for return to handler/thread 8764 * before we commit to changing the SP and xPSR. 8765 */ 8766 bool will_be_handler = (xpsr & XPSR_EXCP) != 0; 8767 if (return_to_handler != will_be_handler) { 8768 /* Take an INVPC UsageFault on the current stack. 8769 * By this point we will have switched to the security state 8770 * for the background state, so this UsageFault will target 8771 * that state. 8772 */ 8773 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8774 env->v7m.secure); 8775 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8776 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " 8777 "stackframe: failed exception return integrity " 8778 "check\n"); 8779 v7m_exception_taken(cpu, excret, true, false); 8780 return; 8781 } 8782 } 8783 8784 if (!ftype) { 8785 /* FP present and we need to handle it */ 8786 if (!return_to_secure && 8787 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) { 8788 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8789 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; 8790 qemu_log_mask(CPU_LOG_INT, 8791 "...taking SecureFault on existing stackframe: " 8792 "Secure LSPACT set but exception return is " 8793 "not to secure state\n"); 8794 v7m_exception_taken(cpu, excret, true, false); 8795 return; 8796 } 8797 8798 restore_s16_s31 = return_to_secure && 8799 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK); 8800 8801 if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) { 8802 /* State in FPU is still valid, just clear LSPACT */ 8803 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK; 8804 } else { 8805 int i; 8806 uint32_t fpscr; 8807 bool cpacr_pass, nsacr_pass; 8808 8809 cpacr_pass = v7m_cpacr_pass(env, return_to_secure, 8810 return_to_priv); 8811 nsacr_pass = return_to_secure || 8812 extract32(env->v7m.nsacr, 10, 1); 8813 8814 if (!cpacr_pass) { 8815 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8816 return_to_secure); 8817 env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK; 8818 qemu_log_mask(CPU_LOG_INT, 8819 "...taking UsageFault on existing " 8820 "stackframe: CPACR.CP10 prevents unstacking " 8821 "FP regs\n"); 8822 v7m_exception_taken(cpu, excret, true, false); 8823 return; 8824 } else if (!nsacr_pass) { 8825 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true); 8826 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK; 8827 qemu_log_mask(CPU_LOG_INT, 8828 "...taking Secure UsageFault on existing " 8829 "stackframe: NSACR.CP10 prevents unstacking " 8830 "FP regs\n"); 8831 v7m_exception_taken(cpu, excret, true, false); 8832 return; 8833 } 8834 8835 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) { 8836 uint32_t slo, shi; 8837 uint64_t dn; 8838 uint32_t faddr = frameptr + 0x20 + 4 * i; 8839 8840 if (i >= 16) { 8841 faddr += 8; /* Skip the slot for the FPSCR */ 8842 } 8843 8844 pop_ok = pop_ok && 8845 v7m_stack_read(cpu, &slo, faddr, mmu_idx) && 8846 v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx); 8847 8848 if (!pop_ok) { 8849 break; 8850 } 8851 8852 dn = (uint64_t)shi << 32 | slo; 8853 *aa32_vfp_dreg(env, i / 2) = dn; 8854 } 8855 pop_ok = pop_ok && 8856 v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx); 8857 if (pop_ok) { 8858 vfp_set_fpscr(env, fpscr); 8859 } 8860 if (!pop_ok) { 8861 /* 8862 * These regs are 0 if security extension present; 8863 * otherwise merely UNKNOWN. We zero always. 8864 */ 8865 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) { 8866 *aa32_vfp_dreg(env, i / 2) = 0; 8867 } 8868 vfp_set_fpscr(env, 0); 8869 } 8870 } 8871 } 8872 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S], 8873 V7M_CONTROL, FPCA, !ftype); 8874 8875 /* Commit to consuming the stack frame */ 8876 frameptr += 0x20; 8877 if (!ftype) { 8878 frameptr += 0x48; 8879 if (restore_s16_s31) { 8880 frameptr += 0x40; 8881 } 8882 } 8883 /* Undo stack alignment (the SPREALIGN bit indicates that the original 8884 * pre-exception SP was not 8-aligned and we added a padding word to 8885 * align it, so we undo this by ORing in the bit that increases it 8886 * from the current 8-aligned value to the 8-unaligned value. (Adding 4 8887 * would work too but a logical OR is how the pseudocode specifies it.) 8888 */ 8889 if (xpsr & XPSR_SPREALIGN) { 8890 frameptr |= 4; 8891 } 8892 *frame_sp_p = frameptr; 8893 } 8894 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */ 8895 xpsr_write(env, xpsr, ~(XPSR_SPREALIGN | XPSR_SFPA)); 8896 8897 if (env->v7m.secure) { 8898 bool sfpa = xpsr & XPSR_SFPA; 8899 8900 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S], 8901 V7M_CONTROL, SFPA, sfpa); 8902 } 8903 8904 /* The restored xPSR exception field will be zero if we're 8905 * resuming in Thread mode. If that doesn't match what the 8906 * exception return excret specified then this is a UsageFault. 8907 * v7M requires we make this check here; v8M did it earlier. 8908 */ 8909 if (return_to_handler != arm_v7m_is_handler_mode(env)) { 8910 /* Take an INVPC UsageFault by pushing the stack again; 8911 * we know we're v7M so this is never a Secure UsageFault. 8912 */ 8913 bool ignore_stackfaults; 8914 8915 assert(!arm_feature(env, ARM_FEATURE_V8)); 8916 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false); 8917 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8918 ignore_stackfaults = v7m_push_stack(cpu); 8919 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: " 8920 "failed exception return integrity check\n"); 8921 v7m_exception_taken(cpu, excret, false, ignore_stackfaults); 8922 return; 8923 } 8924 8925 /* Otherwise, we have a successful exception exit. */ 8926 arm_clear_exclusive(env); 8927 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n"); 8928 } 8929 8930 static bool do_v7m_function_return(ARMCPU *cpu) 8931 { 8932 /* v8M security extensions magic function return. 8933 * We may either: 8934 * (1) throw an exception (longjump) 8935 * (2) return true if we successfully handled the function return 8936 * (3) return false if we failed a consistency check and have 8937 * pended a UsageFault that needs to be taken now 8938 * 8939 * At this point the magic return value is split between env->regs[15] 8940 * and env->thumb. We don't bother to reconstitute it because we don't 8941 * need it (all values are handled the same way). 8942 */ 8943 CPUARMState *env = &cpu->env; 8944 uint32_t newpc, newpsr, newpsr_exc; 8945 8946 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n"); 8947 8948 { 8949 bool threadmode, spsel; 8950 TCGMemOpIdx oi; 8951 ARMMMUIdx mmu_idx; 8952 uint32_t *frame_sp_p; 8953 uint32_t frameptr; 8954 8955 /* Pull the return address and IPSR from the Secure stack */ 8956 threadmode = !arm_v7m_is_handler_mode(env); 8957 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK; 8958 8959 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel); 8960 frameptr = *frame_sp_p; 8961 8962 /* These loads may throw an exception (for MPU faults). We want to 8963 * do them as secure, so work out what MMU index that is. 8964 */ 8965 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true); 8966 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx)); 8967 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0); 8968 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0); 8969 8970 /* Consistency checks on new IPSR */ 8971 newpsr_exc = newpsr & XPSR_EXCP; 8972 if (!((env->v7m.exception == 0 && newpsr_exc == 0) || 8973 (env->v7m.exception == 1 && newpsr_exc != 0))) { 8974 /* Pend the fault and tell our caller to take it */ 8975 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8976 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8977 env->v7m.secure); 8978 qemu_log_mask(CPU_LOG_INT, 8979 "...taking INVPC UsageFault: " 8980 "IPSR consistency check failed\n"); 8981 return false; 8982 } 8983 8984 *frame_sp_p = frameptr + 8; 8985 } 8986 8987 /* This invalidates frame_sp_p */ 8988 switch_v7m_security_state(env, true); 8989 env->v7m.exception = newpsr_exc; 8990 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 8991 if (newpsr & XPSR_SFPA) { 8992 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK; 8993 } 8994 xpsr_write(env, 0, XPSR_IT); 8995 env->thumb = newpc & 1; 8996 env->regs[15] = newpc & ~1; 8997 8998 qemu_log_mask(CPU_LOG_INT, "...function return successful\n"); 8999 return true; 9000 } 9001 9002 static void arm_log_exception(int idx) 9003 { 9004 if (qemu_loglevel_mask(CPU_LOG_INT)) { 9005 const char *exc = NULL; 9006 static const char * const excnames[] = { 9007 [EXCP_UDEF] = "Undefined Instruction", 9008 [EXCP_SWI] = "SVC", 9009 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 9010 [EXCP_DATA_ABORT] = "Data Abort", 9011 [EXCP_IRQ] = "IRQ", 9012 [EXCP_FIQ] = "FIQ", 9013 [EXCP_BKPT] = "Breakpoint", 9014 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 9015 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 9016 [EXCP_HVC] = "Hypervisor Call", 9017 [EXCP_HYP_TRAP] = "Hypervisor Trap", 9018 [EXCP_SMC] = "Secure Monitor Call", 9019 [EXCP_VIRQ] = "Virtual IRQ", 9020 [EXCP_VFIQ] = "Virtual FIQ", 9021 [EXCP_SEMIHOST] = "Semihosting call", 9022 [EXCP_NOCP] = "v7M NOCP UsageFault", 9023 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 9024 [EXCP_STKOF] = "v8M STKOF UsageFault", 9025 }; 9026 9027 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 9028 exc = excnames[idx]; 9029 } 9030 if (!exc) { 9031 exc = "unknown"; 9032 } 9033 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc); 9034 } 9035 } 9036 9037 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, 9038 uint32_t addr, uint16_t *insn) 9039 { 9040 /* Load a 16-bit portion of a v7M instruction, returning true on success, 9041 * or false on failure (in which case we will have pended the appropriate 9042 * exception). 9043 * We need to do the instruction fetch's MPU and SAU checks 9044 * like this because there is no MMU index that would allow 9045 * doing the load with a single function call. Instead we must 9046 * first check that the security attributes permit the load 9047 * and that they don't mismatch on the two halves of the instruction, 9048 * and then we do the load as a secure load (ie using the security 9049 * attributes of the address, not the CPU, as architecturally required). 9050 */ 9051 CPUState *cs = CPU(cpu); 9052 CPUARMState *env = &cpu->env; 9053 V8M_SAttributes sattrs = {}; 9054 MemTxAttrs attrs = {}; 9055 ARMMMUFaultInfo fi = {}; 9056 MemTxResult txres; 9057 target_ulong page_size; 9058 hwaddr physaddr; 9059 int prot; 9060 9061 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs); 9062 if (!sattrs.nsc || sattrs.ns) { 9063 /* This must be the second half of the insn, and it straddles a 9064 * region boundary with the second half not being S&NSC. 9065 */ 9066 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 9067 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 9068 qemu_log_mask(CPU_LOG_INT, 9069 "...really SecureFault with SFSR.INVEP\n"); 9070 return false; 9071 } 9072 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx, 9073 &physaddr, &attrs, &prot, &page_size, &fi, NULL)) { 9074 /* the MPU lookup failed */ 9075 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK; 9076 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure); 9077 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n"); 9078 return false; 9079 } 9080 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr, 9081 attrs, &txres); 9082 if (txres != MEMTX_OK) { 9083 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; 9084 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); 9085 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n"); 9086 return false; 9087 } 9088 return true; 9089 } 9090 9091 static bool v7m_handle_execute_nsc(ARMCPU *cpu) 9092 { 9093 /* Check whether this attempt to execute code in a Secure & NS-Callable 9094 * memory region is for an SG instruction; if so, then emulate the 9095 * effect of the SG instruction and return true. Otherwise pend 9096 * the correct kind of exception and return false. 9097 */ 9098 CPUARMState *env = &cpu->env; 9099 ARMMMUIdx mmu_idx; 9100 uint16_t insn; 9101 9102 /* We should never get here unless get_phys_addr_pmsav8() caused 9103 * an exception for NS executing in S&NSC memory. 9104 */ 9105 assert(!env->v7m.secure); 9106 assert(arm_feature(env, ARM_FEATURE_M_SECURITY)); 9107 9108 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */ 9109 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true); 9110 9111 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) { 9112 return false; 9113 } 9114 9115 if (!env->thumb) { 9116 goto gen_invep; 9117 } 9118 9119 if (insn != 0xe97f) { 9120 /* Not an SG instruction first half (we choose the IMPDEF 9121 * early-SG-check option). 9122 */ 9123 goto gen_invep; 9124 } 9125 9126 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) { 9127 return false; 9128 } 9129 9130 if (insn != 0xe97f) { 9131 /* Not an SG instruction second half (yes, both halves of the SG 9132 * insn have the same hex value) 9133 */ 9134 goto gen_invep; 9135 } 9136 9137 /* OK, we have confirmed that we really have an SG instruction. 9138 * We know we're NS in S memory so don't need to repeat those checks. 9139 */ 9140 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32 9141 ", executing it\n", env->regs[15]); 9142 env->regs[14] &= ~1; 9143 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 9144 switch_v7m_security_state(env, true); 9145 xpsr_write(env, 0, XPSR_IT); 9146 env->regs[15] += 4; 9147 return true; 9148 9149 gen_invep: 9150 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 9151 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 9152 qemu_log_mask(CPU_LOG_INT, 9153 "...really SecureFault with SFSR.INVEP\n"); 9154 return false; 9155 } 9156 9157 void arm_v7m_cpu_do_interrupt(CPUState *cs) 9158 { 9159 ARMCPU *cpu = ARM_CPU(cs); 9160 CPUARMState *env = &cpu->env; 9161 uint32_t lr; 9162 bool ignore_stackfaults; 9163 9164 arm_log_exception(cs->exception_index); 9165 9166 /* For exceptions we just mark as pending on the NVIC, and let that 9167 handle it. */ 9168 switch (cs->exception_index) { 9169 case EXCP_UDEF: 9170 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 9171 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK; 9172 break; 9173 case EXCP_NOCP: 9174 { 9175 /* 9176 * NOCP might be directed to something other than the current 9177 * security state if this fault is because of NSACR; we indicate 9178 * the target security state using exception.target_el. 9179 */ 9180 int target_secstate; 9181 9182 if (env->exception.target_el == 3) { 9183 target_secstate = M_REG_S; 9184 } else { 9185 target_secstate = env->v7m.secure; 9186 } 9187 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate); 9188 env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK; 9189 break; 9190 } 9191 case EXCP_INVSTATE: 9192 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 9193 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK; 9194 break; 9195 case EXCP_STKOF: 9196 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 9197 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 9198 break; 9199 case EXCP_SWI: 9200 /* The PC already points to the next instruction. */ 9201 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure); 9202 break; 9203 case EXCP_PREFETCH_ABORT: 9204 case EXCP_DATA_ABORT: 9205 /* Note that for M profile we don't have a guest facing FSR, but 9206 * the env->exception.fsr will be populated by the code that 9207 * raises the fault, in the A profile short-descriptor format. 9208 */ 9209 switch (env->exception.fsr & 0xf) { 9210 case M_FAKE_FSR_NSC_EXEC: 9211 /* Exception generated when we try to execute code at an address 9212 * which is marked as Secure & Non-Secure Callable and the CPU 9213 * is in the Non-Secure state. The only instruction which can 9214 * be executed like this is SG (and that only if both halves of 9215 * the SG instruction have the same security attributes.) 9216 * Everything else must generate an INVEP SecureFault, so we 9217 * emulate the SG instruction here. 9218 */ 9219 if (v7m_handle_execute_nsc(cpu)) { 9220 return; 9221 } 9222 break; 9223 case M_FAKE_FSR_SFAULT: 9224 /* Various flavours of SecureFault for attempts to execute or 9225 * access data in the wrong security state. 9226 */ 9227 switch (cs->exception_index) { 9228 case EXCP_PREFETCH_ABORT: 9229 if (env->v7m.secure) { 9230 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK; 9231 qemu_log_mask(CPU_LOG_INT, 9232 "...really SecureFault with SFSR.INVTRAN\n"); 9233 } else { 9234 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 9235 qemu_log_mask(CPU_LOG_INT, 9236 "...really SecureFault with SFSR.INVEP\n"); 9237 } 9238 break; 9239 case EXCP_DATA_ABORT: 9240 /* This must be an NS access to S memory */ 9241 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK; 9242 qemu_log_mask(CPU_LOG_INT, 9243 "...really SecureFault with SFSR.AUVIOL\n"); 9244 break; 9245 } 9246 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 9247 break; 9248 case 0x8: /* External Abort */ 9249 switch (cs->exception_index) { 9250 case EXCP_PREFETCH_ABORT: 9251 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; 9252 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n"); 9253 break; 9254 case EXCP_DATA_ABORT: 9255 env->v7m.cfsr[M_REG_NS] |= 9256 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK); 9257 env->v7m.bfar = env->exception.vaddress; 9258 qemu_log_mask(CPU_LOG_INT, 9259 "...with CFSR.PRECISERR and BFAR 0x%x\n", 9260 env->v7m.bfar); 9261 break; 9262 } 9263 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); 9264 break; 9265 default: 9266 /* All other FSR values are either MPU faults or "can't happen 9267 * for M profile" cases. 9268 */ 9269 switch (cs->exception_index) { 9270 case EXCP_PREFETCH_ABORT: 9271 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK; 9272 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n"); 9273 break; 9274 case EXCP_DATA_ABORT: 9275 env->v7m.cfsr[env->v7m.secure] |= 9276 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK); 9277 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress; 9278 qemu_log_mask(CPU_LOG_INT, 9279 "...with CFSR.DACCVIOL and MMFAR 0x%x\n", 9280 env->v7m.mmfar[env->v7m.secure]); 9281 break; 9282 } 9283 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, 9284 env->v7m.secure); 9285 break; 9286 } 9287 break; 9288 case EXCP_BKPT: 9289 if (semihosting_enabled()) { 9290 int nr; 9291 nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff; 9292 if (nr == 0xab) { 9293 env->regs[15] += 2; 9294 qemu_log_mask(CPU_LOG_INT, 9295 "...handling as semihosting call 0x%x\n", 9296 env->regs[0]); 9297 env->regs[0] = do_arm_semihosting(env); 9298 return; 9299 } 9300 } 9301 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false); 9302 break; 9303 case EXCP_IRQ: 9304 break; 9305 case EXCP_EXCEPTION_EXIT: 9306 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) { 9307 /* Must be v8M security extension function return */ 9308 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC); 9309 assert(arm_feature(env, ARM_FEATURE_M_SECURITY)); 9310 if (do_v7m_function_return(cpu)) { 9311 return; 9312 } 9313 } else { 9314 do_v7m_exception_exit(cpu); 9315 return; 9316 } 9317 break; 9318 default: 9319 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9320 return; /* Never happens. Keep compiler happy. */ 9321 } 9322 9323 if (arm_feature(env, ARM_FEATURE_V8)) { 9324 lr = R_V7M_EXCRET_RES1_MASK | 9325 R_V7M_EXCRET_DCRS_MASK; 9326 /* The S bit indicates whether we should return to Secure 9327 * or NonSecure (ie our current state). 9328 * The ES bit indicates whether we're taking this exception 9329 * to Secure or NonSecure (ie our target state). We set it 9330 * later, in v7m_exception_taken(). 9331 * The SPSEL bit is also set in v7m_exception_taken() for v8M. 9332 * This corresponds to the ARM ARM pseudocode for v8M setting 9333 * some LR bits in PushStack() and some in ExceptionTaken(); 9334 * the distinction matters for the tailchain cases where we 9335 * can take an exception without pushing the stack. 9336 */ 9337 if (env->v7m.secure) { 9338 lr |= R_V7M_EXCRET_S_MASK; 9339 } 9340 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) { 9341 lr |= R_V7M_EXCRET_FTYPE_MASK; 9342 } 9343 } else { 9344 lr = R_V7M_EXCRET_RES1_MASK | 9345 R_V7M_EXCRET_S_MASK | 9346 R_V7M_EXCRET_DCRS_MASK | 9347 R_V7M_EXCRET_FTYPE_MASK | 9348 R_V7M_EXCRET_ES_MASK; 9349 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) { 9350 lr |= R_V7M_EXCRET_SPSEL_MASK; 9351 } 9352 } 9353 if (!arm_v7m_is_handler_mode(env)) { 9354 lr |= R_V7M_EXCRET_MODE_MASK; 9355 } 9356 9357 ignore_stackfaults = v7m_push_stack(cpu); 9358 v7m_exception_taken(cpu, lr, false, ignore_stackfaults); 9359 } 9360 9361 /* Function used to synchronize QEMU's AArch64 register set with AArch32 9362 * register set. This is necessary when switching between AArch32 and AArch64 9363 * execution state. 9364 */ 9365 void aarch64_sync_32_to_64(CPUARMState *env) 9366 { 9367 int i; 9368 uint32_t mode = env->uncached_cpsr & CPSR_M; 9369 9370 /* We can blanket copy R[0:7] to X[0:7] */ 9371 for (i = 0; i < 8; i++) { 9372 env->xregs[i] = env->regs[i]; 9373 } 9374 9375 /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 9376 * Otherwise, they come from the banked user regs. 9377 */ 9378 if (mode == ARM_CPU_MODE_FIQ) { 9379 for (i = 8; i < 13; i++) { 9380 env->xregs[i] = env->usr_regs[i - 8]; 9381 } 9382 } else { 9383 for (i = 8; i < 13; i++) { 9384 env->xregs[i] = env->regs[i]; 9385 } 9386 } 9387 9388 /* Registers x13-x23 are the various mode SP and FP registers. Registers 9389 * r13 and r14 are only copied if we are in that mode, otherwise we copy 9390 * from the mode banked register. 9391 */ 9392 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 9393 env->xregs[13] = env->regs[13]; 9394 env->xregs[14] = env->regs[14]; 9395 } else { 9396 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 9397 /* HYP is an exception in that it is copied from r14 */ 9398 if (mode == ARM_CPU_MODE_HYP) { 9399 env->xregs[14] = env->regs[14]; 9400 } else { 9401 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 9402 } 9403 } 9404 9405 if (mode == ARM_CPU_MODE_HYP) { 9406 env->xregs[15] = env->regs[13]; 9407 } else { 9408 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 9409 } 9410 9411 if (mode == ARM_CPU_MODE_IRQ) { 9412 env->xregs[16] = env->regs[14]; 9413 env->xregs[17] = env->regs[13]; 9414 } else { 9415 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 9416 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 9417 } 9418 9419 if (mode == ARM_CPU_MODE_SVC) { 9420 env->xregs[18] = env->regs[14]; 9421 env->xregs[19] = env->regs[13]; 9422 } else { 9423 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 9424 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 9425 } 9426 9427 if (mode == ARM_CPU_MODE_ABT) { 9428 env->xregs[20] = env->regs[14]; 9429 env->xregs[21] = env->regs[13]; 9430 } else { 9431 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 9432 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 9433 } 9434 9435 if (mode == ARM_CPU_MODE_UND) { 9436 env->xregs[22] = env->regs[14]; 9437 env->xregs[23] = env->regs[13]; 9438 } else { 9439 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 9440 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 9441 } 9442 9443 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 9444 * mode, then we can copy from r8-r14. Otherwise, we copy from the 9445 * FIQ bank for r8-r14. 9446 */ 9447 if (mode == ARM_CPU_MODE_FIQ) { 9448 for (i = 24; i < 31; i++) { 9449 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 9450 } 9451 } else { 9452 for (i = 24; i < 29; i++) { 9453 env->xregs[i] = env->fiq_regs[i - 24]; 9454 } 9455 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 9456 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 9457 } 9458 9459 env->pc = env->regs[15]; 9460 } 9461 9462 /* Function used to synchronize QEMU's AArch32 register set with AArch64 9463 * register set. This is necessary when switching between AArch32 and AArch64 9464 * execution state. 9465 */ 9466 void aarch64_sync_64_to_32(CPUARMState *env) 9467 { 9468 int i; 9469 uint32_t mode = env->uncached_cpsr & CPSR_M; 9470 9471 /* We can blanket copy X[0:7] to R[0:7] */ 9472 for (i = 0; i < 8; i++) { 9473 env->regs[i] = env->xregs[i]; 9474 } 9475 9476 /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 9477 * Otherwise, we copy x8-x12 into the banked user regs. 9478 */ 9479 if (mode == ARM_CPU_MODE_FIQ) { 9480 for (i = 8; i < 13; i++) { 9481 env->usr_regs[i - 8] = env->xregs[i]; 9482 } 9483 } else { 9484 for (i = 8; i < 13; i++) { 9485 env->regs[i] = env->xregs[i]; 9486 } 9487 } 9488 9489 /* Registers r13 & r14 depend on the current mode. 9490 * If we are in a given mode, we copy the corresponding x registers to r13 9491 * and r14. Otherwise, we copy the x register to the banked r13 and r14 9492 * for the mode. 9493 */ 9494 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 9495 env->regs[13] = env->xregs[13]; 9496 env->regs[14] = env->xregs[14]; 9497 } else { 9498 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 9499 9500 /* HYP is an exception in that it does not have its own banked r14 but 9501 * shares the USR r14 9502 */ 9503 if (mode == ARM_CPU_MODE_HYP) { 9504 env->regs[14] = env->xregs[14]; 9505 } else { 9506 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 9507 } 9508 } 9509 9510 if (mode == ARM_CPU_MODE_HYP) { 9511 env->regs[13] = env->xregs[15]; 9512 } else { 9513 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 9514 } 9515 9516 if (mode == ARM_CPU_MODE_IRQ) { 9517 env->regs[14] = env->xregs[16]; 9518 env->regs[13] = env->xregs[17]; 9519 } else { 9520 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 9521 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 9522 } 9523 9524 if (mode == ARM_CPU_MODE_SVC) { 9525 env->regs[14] = env->xregs[18]; 9526 env->regs[13] = env->xregs[19]; 9527 } else { 9528 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 9529 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 9530 } 9531 9532 if (mode == ARM_CPU_MODE_ABT) { 9533 env->regs[14] = env->xregs[20]; 9534 env->regs[13] = env->xregs[21]; 9535 } else { 9536 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 9537 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 9538 } 9539 9540 if (mode == ARM_CPU_MODE_UND) { 9541 env->regs[14] = env->xregs[22]; 9542 env->regs[13] = env->xregs[23]; 9543 } else { 9544 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 9545 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 9546 } 9547 9548 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 9549 * mode, then we can copy to r8-r14. Otherwise, we copy to the 9550 * FIQ bank for r8-r14. 9551 */ 9552 if (mode == ARM_CPU_MODE_FIQ) { 9553 for (i = 24; i < 31; i++) { 9554 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 9555 } 9556 } else { 9557 for (i = 24; i < 29; i++) { 9558 env->fiq_regs[i - 24] = env->xregs[i]; 9559 } 9560 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 9561 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 9562 } 9563 9564 env->regs[15] = env->pc; 9565 } 9566 9567 static void take_aarch32_exception(CPUARMState *env, int new_mode, 9568 uint32_t mask, uint32_t offset, 9569 uint32_t newpc) 9570 { 9571 /* Change the CPU state so as to actually take the exception. */ 9572 switch_mode(env, new_mode); 9573 /* 9574 * For exceptions taken to AArch32 we must clear the SS bit in both 9575 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 9576 */ 9577 env->uncached_cpsr &= ~PSTATE_SS; 9578 env->spsr = cpsr_read(env); 9579 /* Clear IT bits. */ 9580 env->condexec_bits = 0; 9581 /* Switch to the new mode, and to the correct instruction set. */ 9582 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 9583 /* Set new mode endianness */ 9584 env->uncached_cpsr &= ~CPSR_E; 9585 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) { 9586 env->uncached_cpsr |= CPSR_E; 9587 } 9588 /* J and IL must always be cleared for exception entry */ 9589 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 9590 env->daif |= mask; 9591 9592 if (new_mode == ARM_CPU_MODE_HYP) { 9593 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 9594 env->elr_el[2] = env->regs[15]; 9595 } else { 9596 /* 9597 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 9598 * and we should just guard the thumb mode on V4 9599 */ 9600 if (arm_feature(env, ARM_FEATURE_V4T)) { 9601 env->thumb = 9602 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 9603 } 9604 env->regs[14] = env->regs[15] + offset; 9605 } 9606 env->regs[15] = newpc; 9607 } 9608 9609 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 9610 { 9611 /* 9612 * Handle exception entry to Hyp mode; this is sufficiently 9613 * different to entry to other AArch32 modes that we handle it 9614 * separately here. 9615 * 9616 * The vector table entry used is always the 0x14 Hyp mode entry point, 9617 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp. 9618 * The offset applied to the preferred return address is always zero 9619 * (see DDI0487C.a section G1.12.3). 9620 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 9621 */ 9622 uint32_t addr, mask; 9623 ARMCPU *cpu = ARM_CPU(cs); 9624 CPUARMState *env = &cpu->env; 9625 9626 switch (cs->exception_index) { 9627 case EXCP_UDEF: 9628 addr = 0x04; 9629 break; 9630 case EXCP_SWI: 9631 addr = 0x14; 9632 break; 9633 case EXCP_BKPT: 9634 /* Fall through to prefetch abort. */ 9635 case EXCP_PREFETCH_ABORT: 9636 env->cp15.ifar_s = env->exception.vaddress; 9637 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 9638 (uint32_t)env->exception.vaddress); 9639 addr = 0x0c; 9640 break; 9641 case EXCP_DATA_ABORT: 9642 env->cp15.dfar_s = env->exception.vaddress; 9643 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 9644 (uint32_t)env->exception.vaddress); 9645 addr = 0x10; 9646 break; 9647 case EXCP_IRQ: 9648 addr = 0x18; 9649 break; 9650 case EXCP_FIQ: 9651 addr = 0x1c; 9652 break; 9653 case EXCP_HVC: 9654 addr = 0x08; 9655 break; 9656 case EXCP_HYP_TRAP: 9657 addr = 0x14; 9658 default: 9659 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9660 } 9661 9662 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 9663 if (!arm_feature(env, ARM_FEATURE_V8)) { 9664 /* 9665 * QEMU syndrome values are v8-style. v7 has the IL bit 9666 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 9667 * If this is a v7 CPU, squash the IL bit in those cases. 9668 */ 9669 if (cs->exception_index == EXCP_PREFETCH_ABORT || 9670 (cs->exception_index == EXCP_DATA_ABORT && 9671 !(env->exception.syndrome & ARM_EL_ISV)) || 9672 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 9673 env->exception.syndrome &= ~ARM_EL_IL; 9674 } 9675 } 9676 env->cp15.esr_el[2] = env->exception.syndrome; 9677 } 9678 9679 if (arm_current_el(env) != 2 && addr < 0x14) { 9680 addr = 0x14; 9681 } 9682 9683 mask = 0; 9684 if (!(env->cp15.scr_el3 & SCR_EA)) { 9685 mask |= CPSR_A; 9686 } 9687 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 9688 mask |= CPSR_I; 9689 } 9690 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 9691 mask |= CPSR_F; 9692 } 9693 9694 addr += env->cp15.hvbar; 9695 9696 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 9697 } 9698 9699 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 9700 { 9701 ARMCPU *cpu = ARM_CPU(cs); 9702 CPUARMState *env = &cpu->env; 9703 uint32_t addr; 9704 uint32_t mask; 9705 int new_mode; 9706 uint32_t offset; 9707 uint32_t moe; 9708 9709 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 9710 switch (syn_get_ec(env->exception.syndrome)) { 9711 case EC_BREAKPOINT: 9712 case EC_BREAKPOINT_SAME_EL: 9713 moe = 1; 9714 break; 9715 case EC_WATCHPOINT: 9716 case EC_WATCHPOINT_SAME_EL: 9717 moe = 10; 9718 break; 9719 case EC_AA32_BKPT: 9720 moe = 3; 9721 break; 9722 case EC_VECTORCATCH: 9723 moe = 5; 9724 break; 9725 default: 9726 moe = 0; 9727 break; 9728 } 9729 9730 if (moe) { 9731 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 9732 } 9733 9734 if (env->exception.target_el == 2) { 9735 arm_cpu_do_interrupt_aarch32_hyp(cs); 9736 return; 9737 } 9738 9739 switch (cs->exception_index) { 9740 case EXCP_UDEF: 9741 new_mode = ARM_CPU_MODE_UND; 9742 addr = 0x04; 9743 mask = CPSR_I; 9744 if (env->thumb) 9745 offset = 2; 9746 else 9747 offset = 4; 9748 break; 9749 case EXCP_SWI: 9750 new_mode = ARM_CPU_MODE_SVC; 9751 addr = 0x08; 9752 mask = CPSR_I; 9753 /* The PC already points to the next instruction. */ 9754 offset = 0; 9755 break; 9756 case EXCP_BKPT: 9757 /* Fall through to prefetch abort. */ 9758 case EXCP_PREFETCH_ABORT: 9759 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 9760 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 9761 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 9762 env->exception.fsr, (uint32_t)env->exception.vaddress); 9763 new_mode = ARM_CPU_MODE_ABT; 9764 addr = 0x0c; 9765 mask = CPSR_A | CPSR_I; 9766 offset = 4; 9767 break; 9768 case EXCP_DATA_ABORT: 9769 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 9770 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 9771 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 9772 env->exception.fsr, 9773 (uint32_t)env->exception.vaddress); 9774 new_mode = ARM_CPU_MODE_ABT; 9775 addr = 0x10; 9776 mask = CPSR_A | CPSR_I; 9777 offset = 8; 9778 break; 9779 case EXCP_IRQ: 9780 new_mode = ARM_CPU_MODE_IRQ; 9781 addr = 0x18; 9782 /* Disable IRQ and imprecise data aborts. */ 9783 mask = CPSR_A | CPSR_I; 9784 offset = 4; 9785 if (env->cp15.scr_el3 & SCR_IRQ) { 9786 /* IRQ routed to monitor mode */ 9787 new_mode = ARM_CPU_MODE_MON; 9788 mask |= CPSR_F; 9789 } 9790 break; 9791 case EXCP_FIQ: 9792 new_mode = ARM_CPU_MODE_FIQ; 9793 addr = 0x1c; 9794 /* Disable FIQ, IRQ and imprecise data aborts. */ 9795 mask = CPSR_A | CPSR_I | CPSR_F; 9796 if (env->cp15.scr_el3 & SCR_FIQ) { 9797 /* FIQ routed to monitor mode */ 9798 new_mode = ARM_CPU_MODE_MON; 9799 } 9800 offset = 4; 9801 break; 9802 case EXCP_VIRQ: 9803 new_mode = ARM_CPU_MODE_IRQ; 9804 addr = 0x18; 9805 /* Disable IRQ and imprecise data aborts. */ 9806 mask = CPSR_A | CPSR_I; 9807 offset = 4; 9808 break; 9809 case EXCP_VFIQ: 9810 new_mode = ARM_CPU_MODE_FIQ; 9811 addr = 0x1c; 9812 /* Disable FIQ, IRQ and imprecise data aborts. */ 9813 mask = CPSR_A | CPSR_I | CPSR_F; 9814 offset = 4; 9815 break; 9816 case EXCP_SMC: 9817 new_mode = ARM_CPU_MODE_MON; 9818 addr = 0x08; 9819 mask = CPSR_A | CPSR_I | CPSR_F; 9820 offset = 0; 9821 break; 9822 default: 9823 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9824 return; /* Never happens. Keep compiler happy. */ 9825 } 9826 9827 if (new_mode == ARM_CPU_MODE_MON) { 9828 addr += env->cp15.mvbar; 9829 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 9830 /* High vectors. When enabled, base address cannot be remapped. */ 9831 addr += 0xffff0000; 9832 } else { 9833 /* ARM v7 architectures provide a vector base address register to remap 9834 * the interrupt vector table. 9835 * This register is only followed in non-monitor mode, and is banked. 9836 * Note: only bits 31:5 are valid. 9837 */ 9838 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 9839 } 9840 9841 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 9842 env->cp15.scr_el3 &= ~SCR_NS; 9843 } 9844 9845 take_aarch32_exception(env, new_mode, mask, offset, addr); 9846 } 9847 9848 /* Handle exception entry to a target EL which is using AArch64 */ 9849 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 9850 { 9851 ARMCPU *cpu = ARM_CPU(cs); 9852 CPUARMState *env = &cpu->env; 9853 unsigned int new_el = env->exception.target_el; 9854 target_ulong addr = env->cp15.vbar_el[new_el]; 9855 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 9856 unsigned int cur_el = arm_current_el(env); 9857 9858 /* 9859 * Note that new_el can never be 0. If cur_el is 0, then 9860 * el0_a64 is is_a64(), else el0_a64 is ignored. 9861 */ 9862 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 9863 9864 if (cur_el < new_el) { 9865 /* Entry vector offset depends on whether the implemented EL 9866 * immediately lower than the target level is using AArch32 or AArch64 9867 */ 9868 bool is_aa64; 9869 9870 switch (new_el) { 9871 case 3: 9872 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 9873 break; 9874 case 2: 9875 is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0; 9876 break; 9877 case 1: 9878 is_aa64 = is_a64(env); 9879 break; 9880 default: 9881 g_assert_not_reached(); 9882 } 9883 9884 if (is_aa64) { 9885 addr += 0x400; 9886 } else { 9887 addr += 0x600; 9888 } 9889 } else if (pstate_read(env) & PSTATE_SP) { 9890 addr += 0x200; 9891 } 9892 9893 switch (cs->exception_index) { 9894 case EXCP_PREFETCH_ABORT: 9895 case EXCP_DATA_ABORT: 9896 env->cp15.far_el[new_el] = env->exception.vaddress; 9897 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 9898 env->cp15.far_el[new_el]); 9899 /* fall through */ 9900 case EXCP_BKPT: 9901 case EXCP_UDEF: 9902 case EXCP_SWI: 9903 case EXCP_HVC: 9904 case EXCP_HYP_TRAP: 9905 case EXCP_SMC: 9906 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) { 9907 /* 9908 * QEMU internal FP/SIMD syndromes from AArch32 include the 9909 * TA and coproc fields which are only exposed if the exception 9910 * is taken to AArch32 Hyp mode. Mask them out to get a valid 9911 * AArch64 format syndrome. 9912 */ 9913 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 9914 } 9915 env->cp15.esr_el[new_el] = env->exception.syndrome; 9916 break; 9917 case EXCP_IRQ: 9918 case EXCP_VIRQ: 9919 addr += 0x80; 9920 break; 9921 case EXCP_FIQ: 9922 case EXCP_VFIQ: 9923 addr += 0x100; 9924 break; 9925 case EXCP_SEMIHOST: 9926 qemu_log_mask(CPU_LOG_INT, 9927 "...handling as semihosting call 0x%" PRIx64 "\n", 9928 env->xregs[0]); 9929 env->xregs[0] = do_arm_semihosting(env); 9930 return; 9931 default: 9932 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9933 } 9934 9935 if (is_a64(env)) { 9936 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env); 9937 aarch64_save_sp(env, arm_current_el(env)); 9938 env->elr_el[new_el] = env->pc; 9939 } else { 9940 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env); 9941 env->elr_el[new_el] = env->regs[15]; 9942 9943 aarch64_sync_32_to_64(env); 9944 9945 env->condexec_bits = 0; 9946 } 9947 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 9948 env->elr_el[new_el]); 9949 9950 pstate_write(env, PSTATE_DAIF | new_mode); 9951 env->aarch64 = 1; 9952 aarch64_restore_sp(env, new_el); 9953 9954 env->pc = addr; 9955 9956 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 9957 new_el, env->pc, pstate_read(env)); 9958 } 9959 9960 static inline bool check_for_semihosting(CPUState *cs) 9961 { 9962 /* Check whether this exception is a semihosting call; if so 9963 * then handle it and return true; otherwise return false. 9964 */ 9965 ARMCPU *cpu = ARM_CPU(cs); 9966 CPUARMState *env = &cpu->env; 9967 9968 if (is_a64(env)) { 9969 if (cs->exception_index == EXCP_SEMIHOST) { 9970 /* This is always the 64-bit semihosting exception. 9971 * The "is this usermode" and "is semihosting enabled" 9972 * checks have been done at translate time. 9973 */ 9974 qemu_log_mask(CPU_LOG_INT, 9975 "...handling as semihosting call 0x%" PRIx64 "\n", 9976 env->xregs[0]); 9977 env->xregs[0] = do_arm_semihosting(env); 9978 return true; 9979 } 9980 return false; 9981 } else { 9982 uint32_t imm; 9983 9984 /* Only intercept calls from privileged modes, to provide some 9985 * semblance of security. 9986 */ 9987 if (cs->exception_index != EXCP_SEMIHOST && 9988 (!semihosting_enabled() || 9989 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) { 9990 return false; 9991 } 9992 9993 switch (cs->exception_index) { 9994 case EXCP_SEMIHOST: 9995 /* This is always a semihosting call; the "is this usermode" 9996 * and "is semihosting enabled" checks have been done at 9997 * translate time. 9998 */ 9999 break; 10000 case EXCP_SWI: 10001 /* Check for semihosting interrupt. */ 10002 if (env->thumb) { 10003 imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env)) 10004 & 0xff; 10005 if (imm == 0xab) { 10006 break; 10007 } 10008 } else { 10009 imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env)) 10010 & 0xffffff; 10011 if (imm == 0x123456) { 10012 break; 10013 } 10014 } 10015 return false; 10016 case EXCP_BKPT: 10017 /* See if this is a semihosting syscall. */ 10018 if (env->thumb) { 10019 imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) 10020 & 0xff; 10021 if (imm == 0xab) { 10022 env->regs[15] += 2; 10023 break; 10024 } 10025 } 10026 return false; 10027 default: 10028 return false; 10029 } 10030 10031 qemu_log_mask(CPU_LOG_INT, 10032 "...handling as semihosting call 0x%x\n", 10033 env->regs[0]); 10034 env->regs[0] = do_arm_semihosting(env); 10035 return true; 10036 } 10037 } 10038 10039 /* Handle a CPU exception for A and R profile CPUs. 10040 * Do any appropriate logging, handle PSCI calls, and then hand off 10041 * to the AArch64-entry or AArch32-entry function depending on the 10042 * target exception level's register width. 10043 */ 10044 void arm_cpu_do_interrupt(CPUState *cs) 10045 { 10046 ARMCPU *cpu = ARM_CPU(cs); 10047 CPUARMState *env = &cpu->env; 10048 unsigned int new_el = env->exception.target_el; 10049 10050 assert(!arm_feature(env, ARM_FEATURE_M)); 10051 10052 arm_log_exception(cs->exception_index); 10053 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 10054 new_el); 10055 if (qemu_loglevel_mask(CPU_LOG_INT) 10056 && !excp_is_internal(cs->exception_index)) { 10057 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 10058 syn_get_ec(env->exception.syndrome), 10059 env->exception.syndrome); 10060 } 10061 10062 if (arm_is_psci_call(cpu, cs->exception_index)) { 10063 arm_handle_psci_call(cpu); 10064 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 10065 return; 10066 } 10067 10068 /* Semihosting semantics depend on the register width of the 10069 * code that caused the exception, not the target exception level, 10070 * so must be handled here. 10071 */ 10072 if (check_for_semihosting(cs)) { 10073 return; 10074 } 10075 10076 /* Hooks may change global state so BQL should be held, also the 10077 * BQL needs to be held for any modification of 10078 * cs->interrupt_request. 10079 */ 10080 g_assert(qemu_mutex_iothread_locked()); 10081 10082 arm_call_pre_el_change_hook(cpu); 10083 10084 assert(!excp_is_internal(cs->exception_index)); 10085 if (arm_el_is_aa64(env, new_el)) { 10086 arm_cpu_do_interrupt_aarch64(cs); 10087 } else { 10088 arm_cpu_do_interrupt_aarch32(cs); 10089 } 10090 10091 arm_call_el_change_hook(cpu); 10092 10093 if (!kvm_enabled()) { 10094 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 10095 } 10096 } 10097 #endif /* !CONFIG_USER_ONLY */ 10098 10099 /* Return the exception level which controls this address translation regime */ 10100 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx) 10101 { 10102 switch (mmu_idx) { 10103 case ARMMMUIdx_S2NS: 10104 case ARMMMUIdx_S1E2: 10105 return 2; 10106 case ARMMMUIdx_S1E3: 10107 return 3; 10108 case ARMMMUIdx_S1SE0: 10109 return arm_el_is_aa64(env, 3) ? 1 : 3; 10110 case ARMMMUIdx_S1SE1: 10111 case ARMMMUIdx_S1NSE0: 10112 case ARMMMUIdx_S1NSE1: 10113 case ARMMMUIdx_MPrivNegPri: 10114 case ARMMMUIdx_MUserNegPri: 10115 case ARMMMUIdx_MPriv: 10116 case ARMMMUIdx_MUser: 10117 case ARMMMUIdx_MSPrivNegPri: 10118 case ARMMMUIdx_MSUserNegPri: 10119 case ARMMMUIdx_MSPriv: 10120 case ARMMMUIdx_MSUser: 10121 return 1; 10122 default: 10123 g_assert_not_reached(); 10124 } 10125 } 10126 10127 #ifndef CONFIG_USER_ONLY 10128 10129 /* Return the SCTLR value which controls this address translation regime */ 10130 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx) 10131 { 10132 return env->cp15.sctlr_el[regime_el(env, mmu_idx)]; 10133 } 10134 10135 /* Return true if the specified stage of address translation is disabled */ 10136 static inline bool regime_translation_disabled(CPUARMState *env, 10137 ARMMMUIdx mmu_idx) 10138 { 10139 if (arm_feature(env, ARM_FEATURE_M)) { 10140 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] & 10141 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 10142 case R_V7M_MPU_CTRL_ENABLE_MASK: 10143 /* Enabled, but not for HardFault and NMI */ 10144 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 10145 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 10146 /* Enabled for all cases */ 10147 return false; 10148 case 0: 10149 default: 10150 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 10151 * we warned about that in armv7m_nvic.c when the guest set it. 10152 */ 10153 return true; 10154 } 10155 } 10156 10157 if (mmu_idx == ARMMMUIdx_S2NS) { 10158 /* HCR.DC means HCR.VM behaves as 1 */ 10159 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0; 10160 } 10161 10162 if (env->cp15.hcr_el2 & HCR_TGE) { 10163 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */ 10164 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) { 10165 return true; 10166 } 10167 } 10168 10169 if ((env->cp15.hcr_el2 & HCR_DC) && 10170 (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) { 10171 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 10172 return true; 10173 } 10174 10175 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 10176 } 10177 10178 static inline bool regime_translation_big_endian(CPUARMState *env, 10179 ARMMMUIdx mmu_idx) 10180 { 10181 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 10182 } 10183 10184 /* Return the TTBR associated with this translation regime */ 10185 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, 10186 int ttbrn) 10187 { 10188 if (mmu_idx == ARMMMUIdx_S2NS) { 10189 return env->cp15.vttbr_el2; 10190 } 10191 if (ttbrn == 0) { 10192 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 10193 } else { 10194 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 10195 } 10196 } 10197 10198 #endif /* !CONFIG_USER_ONLY */ 10199 10200 /* Return the TCR controlling this translation regime */ 10201 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx) 10202 { 10203 if (mmu_idx == ARMMMUIdx_S2NS) { 10204 return &env->cp15.vtcr_el2; 10205 } 10206 return &env->cp15.tcr_el[regime_el(env, mmu_idx)]; 10207 } 10208 10209 /* Convert a possible stage1+2 MMU index into the appropriate 10210 * stage 1 MMU index 10211 */ 10212 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 10213 { 10214 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 10215 mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0); 10216 } 10217 return mmu_idx; 10218 } 10219 10220 /* Return true if the translation regime is using LPAE format page tables */ 10221 static inline bool regime_using_lpae_format(CPUARMState *env, 10222 ARMMMUIdx mmu_idx) 10223 { 10224 int el = regime_el(env, mmu_idx); 10225 if (el == 2 || arm_el_is_aa64(env, el)) { 10226 return true; 10227 } 10228 if (arm_feature(env, ARM_FEATURE_LPAE) 10229 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) { 10230 return true; 10231 } 10232 return false; 10233 } 10234 10235 /* Returns true if the stage 1 translation regime is using LPAE format page 10236 * tables. Used when raising alignment exceptions, whose FSR changes depending 10237 * on whether the long or short descriptor format is in use. */ 10238 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx) 10239 { 10240 mmu_idx = stage_1_mmu_idx(mmu_idx); 10241 10242 return regime_using_lpae_format(env, mmu_idx); 10243 } 10244 10245 #ifndef CONFIG_USER_ONLY 10246 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx) 10247 { 10248 switch (mmu_idx) { 10249 case ARMMMUIdx_S1SE0: 10250 case ARMMMUIdx_S1NSE0: 10251 case ARMMMUIdx_MUser: 10252 case ARMMMUIdx_MSUser: 10253 case ARMMMUIdx_MUserNegPri: 10254 case ARMMMUIdx_MSUserNegPri: 10255 return true; 10256 default: 10257 return false; 10258 case ARMMMUIdx_S12NSE0: 10259 case ARMMMUIdx_S12NSE1: 10260 g_assert_not_reached(); 10261 } 10262 } 10263 10264 /* Translate section/page access permissions to page 10265 * R/W protection flags 10266 * 10267 * @env: CPUARMState 10268 * @mmu_idx: MMU index indicating required translation regime 10269 * @ap: The 3-bit access permissions (AP[2:0]) 10270 * @domain_prot: The 2-bit domain access permissions 10271 */ 10272 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 10273 int ap, int domain_prot) 10274 { 10275 bool is_user = regime_is_user(env, mmu_idx); 10276 10277 if (domain_prot == 3) { 10278 return PAGE_READ | PAGE_WRITE; 10279 } 10280 10281 switch (ap) { 10282 case 0: 10283 if (arm_feature(env, ARM_FEATURE_V7)) { 10284 return 0; 10285 } 10286 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 10287 case SCTLR_S: 10288 return is_user ? 0 : PAGE_READ; 10289 case SCTLR_R: 10290 return PAGE_READ; 10291 default: 10292 return 0; 10293 } 10294 case 1: 10295 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 10296 case 2: 10297 if (is_user) { 10298 return PAGE_READ; 10299 } else { 10300 return PAGE_READ | PAGE_WRITE; 10301 } 10302 case 3: 10303 return PAGE_READ | PAGE_WRITE; 10304 case 4: /* Reserved. */ 10305 return 0; 10306 case 5: 10307 return is_user ? 0 : PAGE_READ; 10308 case 6: 10309 return PAGE_READ; 10310 case 7: 10311 if (!arm_feature(env, ARM_FEATURE_V6K)) { 10312 return 0; 10313 } 10314 return PAGE_READ; 10315 default: 10316 g_assert_not_reached(); 10317 } 10318 } 10319 10320 /* Translate section/page access permissions to page 10321 * R/W protection flags. 10322 * 10323 * @ap: The 2-bit simple AP (AP[2:1]) 10324 * @is_user: TRUE if accessing from PL0 10325 */ 10326 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 10327 { 10328 switch (ap) { 10329 case 0: 10330 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 10331 case 1: 10332 return PAGE_READ | PAGE_WRITE; 10333 case 2: 10334 return is_user ? 0 : PAGE_READ; 10335 case 3: 10336 return PAGE_READ; 10337 default: 10338 g_assert_not_reached(); 10339 } 10340 } 10341 10342 static inline int 10343 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 10344 { 10345 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 10346 } 10347 10348 /* Translate S2 section/page access permissions to protection flags 10349 * 10350 * @env: CPUARMState 10351 * @s2ap: The 2-bit stage2 access permissions (S2AP) 10352 * @xn: XN (execute-never) bit 10353 */ 10354 static int get_S2prot(CPUARMState *env, int s2ap, int xn) 10355 { 10356 int prot = 0; 10357 10358 if (s2ap & 1) { 10359 prot |= PAGE_READ; 10360 } 10361 if (s2ap & 2) { 10362 prot |= PAGE_WRITE; 10363 } 10364 if (!xn) { 10365 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 10366 prot |= PAGE_EXEC; 10367 } 10368 } 10369 return prot; 10370 } 10371 10372 /* Translate section/page access permissions to protection flags 10373 * 10374 * @env: CPUARMState 10375 * @mmu_idx: MMU index indicating required translation regime 10376 * @is_aa64: TRUE if AArch64 10377 * @ap: The 2-bit simple AP (AP[2:1]) 10378 * @ns: NS (non-secure) bit 10379 * @xn: XN (execute-never) bit 10380 * @pxn: PXN (privileged execute-never) bit 10381 */ 10382 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 10383 int ap, int ns, int xn, int pxn) 10384 { 10385 bool is_user = regime_is_user(env, mmu_idx); 10386 int prot_rw, user_rw; 10387 bool have_wxn; 10388 int wxn = 0; 10389 10390 assert(mmu_idx != ARMMMUIdx_S2NS); 10391 10392 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 10393 if (is_user) { 10394 prot_rw = user_rw; 10395 } else { 10396 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 10397 } 10398 10399 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 10400 return prot_rw; 10401 } 10402 10403 /* TODO have_wxn should be replaced with 10404 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 10405 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 10406 * compatible processors have EL2, which is required for [U]WXN. 10407 */ 10408 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 10409 10410 if (have_wxn) { 10411 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 10412 } 10413 10414 if (is_aa64) { 10415 switch (regime_el(env, mmu_idx)) { 10416 case 1: 10417 if (!is_user) { 10418 xn = pxn || (user_rw & PAGE_WRITE); 10419 } 10420 break; 10421 case 2: 10422 case 3: 10423 break; 10424 } 10425 } else if (arm_feature(env, ARM_FEATURE_V7)) { 10426 switch (regime_el(env, mmu_idx)) { 10427 case 1: 10428 case 3: 10429 if (is_user) { 10430 xn = xn || !(user_rw & PAGE_READ); 10431 } else { 10432 int uwxn = 0; 10433 if (have_wxn) { 10434 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 10435 } 10436 xn = xn || !(prot_rw & PAGE_READ) || pxn || 10437 (uwxn && (user_rw & PAGE_WRITE)); 10438 } 10439 break; 10440 case 2: 10441 break; 10442 } 10443 } else { 10444 xn = wxn = 0; 10445 } 10446 10447 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 10448 return prot_rw; 10449 } 10450 return prot_rw | PAGE_EXEC; 10451 } 10452 10453 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 10454 uint32_t *table, uint32_t address) 10455 { 10456 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 10457 TCR *tcr = regime_tcr(env, mmu_idx); 10458 10459 if (address & tcr->mask) { 10460 if (tcr->raw_tcr & TTBCR_PD1) { 10461 /* Translation table walk disabled for TTBR1 */ 10462 return false; 10463 } 10464 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 10465 } else { 10466 if (tcr->raw_tcr & TTBCR_PD0) { 10467 /* Translation table walk disabled for TTBR0 */ 10468 return false; 10469 } 10470 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask; 10471 } 10472 *table |= (address >> 18) & 0x3ffc; 10473 return true; 10474 } 10475 10476 /* Translate a S1 pagetable walk through S2 if needed. */ 10477 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx, 10478 hwaddr addr, MemTxAttrs txattrs, 10479 ARMMMUFaultInfo *fi) 10480 { 10481 if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) && 10482 !regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 10483 target_ulong s2size; 10484 hwaddr s2pa; 10485 int s2prot; 10486 int ret; 10487 ARMCacheAttrs cacheattrs = {}; 10488 ARMCacheAttrs *pcacheattrs = NULL; 10489 10490 if (env->cp15.hcr_el2 & HCR_PTW) { 10491 /* 10492 * PTW means we must fault if this S1 walk touches S2 Device 10493 * memory; otherwise we don't care about the attributes and can 10494 * save the S2 translation the effort of computing them. 10495 */ 10496 pcacheattrs = &cacheattrs; 10497 } 10498 10499 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa, 10500 &txattrs, &s2prot, &s2size, fi, pcacheattrs); 10501 if (ret) { 10502 assert(fi->type != ARMFault_None); 10503 fi->s2addr = addr; 10504 fi->stage2 = true; 10505 fi->s1ptw = true; 10506 return ~0; 10507 } 10508 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) { 10509 /* Access was to Device memory: generate Permission fault */ 10510 fi->type = ARMFault_Permission; 10511 fi->s2addr = addr; 10512 fi->stage2 = true; 10513 fi->s1ptw = true; 10514 return ~0; 10515 } 10516 addr = s2pa; 10517 } 10518 return addr; 10519 } 10520 10521 /* All loads done in the course of a page table walk go through here. */ 10522 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure, 10523 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 10524 { 10525 ARMCPU *cpu = ARM_CPU(cs); 10526 CPUARMState *env = &cpu->env; 10527 MemTxAttrs attrs = {}; 10528 MemTxResult result = MEMTX_OK; 10529 AddressSpace *as; 10530 uint32_t data; 10531 10532 attrs.secure = is_secure; 10533 as = arm_addressspace(cs, attrs); 10534 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 10535 if (fi->s1ptw) { 10536 return 0; 10537 } 10538 if (regime_translation_big_endian(env, mmu_idx)) { 10539 data = address_space_ldl_be(as, addr, attrs, &result); 10540 } else { 10541 data = address_space_ldl_le(as, addr, attrs, &result); 10542 } 10543 if (result == MEMTX_OK) { 10544 return data; 10545 } 10546 fi->type = ARMFault_SyncExternalOnWalk; 10547 fi->ea = arm_extabort_type(result); 10548 return 0; 10549 } 10550 10551 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, 10552 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 10553 { 10554 ARMCPU *cpu = ARM_CPU(cs); 10555 CPUARMState *env = &cpu->env; 10556 MemTxAttrs attrs = {}; 10557 MemTxResult result = MEMTX_OK; 10558 AddressSpace *as; 10559 uint64_t data; 10560 10561 attrs.secure = is_secure; 10562 as = arm_addressspace(cs, attrs); 10563 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 10564 if (fi->s1ptw) { 10565 return 0; 10566 } 10567 if (regime_translation_big_endian(env, mmu_idx)) { 10568 data = address_space_ldq_be(as, addr, attrs, &result); 10569 } else { 10570 data = address_space_ldq_le(as, addr, attrs, &result); 10571 } 10572 if (result == MEMTX_OK) { 10573 return data; 10574 } 10575 fi->type = ARMFault_SyncExternalOnWalk; 10576 fi->ea = arm_extabort_type(result); 10577 return 0; 10578 } 10579 10580 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address, 10581 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10582 hwaddr *phys_ptr, int *prot, 10583 target_ulong *page_size, 10584 ARMMMUFaultInfo *fi) 10585 { 10586 CPUState *cs = CPU(arm_env_get_cpu(env)); 10587 int level = 1; 10588 uint32_t table; 10589 uint32_t desc; 10590 int type; 10591 int ap; 10592 int domain = 0; 10593 int domain_prot; 10594 hwaddr phys_addr; 10595 uint32_t dacr; 10596 10597 /* Pagetable walk. */ 10598 /* Lookup l1 descriptor. */ 10599 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 10600 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 10601 fi->type = ARMFault_Translation; 10602 goto do_fault; 10603 } 10604 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10605 mmu_idx, fi); 10606 if (fi->type != ARMFault_None) { 10607 goto do_fault; 10608 } 10609 type = (desc & 3); 10610 domain = (desc >> 5) & 0x0f; 10611 if (regime_el(env, mmu_idx) == 1) { 10612 dacr = env->cp15.dacr_ns; 10613 } else { 10614 dacr = env->cp15.dacr_s; 10615 } 10616 domain_prot = (dacr >> (domain * 2)) & 3; 10617 if (type == 0) { 10618 /* Section translation fault. */ 10619 fi->type = ARMFault_Translation; 10620 goto do_fault; 10621 } 10622 if (type != 2) { 10623 level = 2; 10624 } 10625 if (domain_prot == 0 || domain_prot == 2) { 10626 fi->type = ARMFault_Domain; 10627 goto do_fault; 10628 } 10629 if (type == 2) { 10630 /* 1Mb section. */ 10631 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 10632 ap = (desc >> 10) & 3; 10633 *page_size = 1024 * 1024; 10634 } else { 10635 /* Lookup l2 entry. */ 10636 if (type == 1) { 10637 /* Coarse pagetable. */ 10638 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 10639 } else { 10640 /* Fine pagetable. */ 10641 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 10642 } 10643 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10644 mmu_idx, fi); 10645 if (fi->type != ARMFault_None) { 10646 goto do_fault; 10647 } 10648 switch (desc & 3) { 10649 case 0: /* Page translation fault. */ 10650 fi->type = ARMFault_Translation; 10651 goto do_fault; 10652 case 1: /* 64k page. */ 10653 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 10654 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 10655 *page_size = 0x10000; 10656 break; 10657 case 2: /* 4k page. */ 10658 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10659 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 10660 *page_size = 0x1000; 10661 break; 10662 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 10663 if (type == 1) { 10664 /* ARMv6/XScale extended small page format */ 10665 if (arm_feature(env, ARM_FEATURE_XSCALE) 10666 || arm_feature(env, ARM_FEATURE_V6)) { 10667 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10668 *page_size = 0x1000; 10669 } else { 10670 /* UNPREDICTABLE in ARMv5; we choose to take a 10671 * page translation fault. 10672 */ 10673 fi->type = ARMFault_Translation; 10674 goto do_fault; 10675 } 10676 } else { 10677 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 10678 *page_size = 0x400; 10679 } 10680 ap = (desc >> 4) & 3; 10681 break; 10682 default: 10683 /* Never happens, but compiler isn't smart enough to tell. */ 10684 abort(); 10685 } 10686 } 10687 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 10688 *prot |= *prot ? PAGE_EXEC : 0; 10689 if (!(*prot & (1 << access_type))) { 10690 /* Access permission fault. */ 10691 fi->type = ARMFault_Permission; 10692 goto do_fault; 10693 } 10694 *phys_ptr = phys_addr; 10695 return false; 10696 do_fault: 10697 fi->domain = domain; 10698 fi->level = level; 10699 return true; 10700 } 10701 10702 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, 10703 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10704 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 10705 target_ulong *page_size, ARMMMUFaultInfo *fi) 10706 { 10707 CPUState *cs = CPU(arm_env_get_cpu(env)); 10708 int level = 1; 10709 uint32_t table; 10710 uint32_t desc; 10711 uint32_t xn; 10712 uint32_t pxn = 0; 10713 int type; 10714 int ap; 10715 int domain = 0; 10716 int domain_prot; 10717 hwaddr phys_addr; 10718 uint32_t dacr; 10719 bool ns; 10720 10721 /* Pagetable walk. */ 10722 /* Lookup l1 descriptor. */ 10723 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 10724 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 10725 fi->type = ARMFault_Translation; 10726 goto do_fault; 10727 } 10728 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10729 mmu_idx, fi); 10730 if (fi->type != ARMFault_None) { 10731 goto do_fault; 10732 } 10733 type = (desc & 3); 10734 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) { 10735 /* Section translation fault, or attempt to use the encoding 10736 * which is Reserved on implementations without PXN. 10737 */ 10738 fi->type = ARMFault_Translation; 10739 goto do_fault; 10740 } 10741 if ((type == 1) || !(desc & (1 << 18))) { 10742 /* Page or Section. */ 10743 domain = (desc >> 5) & 0x0f; 10744 } 10745 if (regime_el(env, mmu_idx) == 1) { 10746 dacr = env->cp15.dacr_ns; 10747 } else { 10748 dacr = env->cp15.dacr_s; 10749 } 10750 if (type == 1) { 10751 level = 2; 10752 } 10753 domain_prot = (dacr >> (domain * 2)) & 3; 10754 if (domain_prot == 0 || domain_prot == 2) { 10755 /* Section or Page domain fault */ 10756 fi->type = ARMFault_Domain; 10757 goto do_fault; 10758 } 10759 if (type != 1) { 10760 if (desc & (1 << 18)) { 10761 /* Supersection. */ 10762 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 10763 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 10764 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 10765 *page_size = 0x1000000; 10766 } else { 10767 /* Section. */ 10768 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 10769 *page_size = 0x100000; 10770 } 10771 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 10772 xn = desc & (1 << 4); 10773 pxn = desc & 1; 10774 ns = extract32(desc, 19, 1); 10775 } else { 10776 if (arm_feature(env, ARM_FEATURE_PXN)) { 10777 pxn = (desc >> 2) & 1; 10778 } 10779 ns = extract32(desc, 3, 1); 10780 /* Lookup l2 entry. */ 10781 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 10782 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10783 mmu_idx, fi); 10784 if (fi->type != ARMFault_None) { 10785 goto do_fault; 10786 } 10787 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 10788 switch (desc & 3) { 10789 case 0: /* Page translation fault. */ 10790 fi->type = ARMFault_Translation; 10791 goto do_fault; 10792 case 1: /* 64k page. */ 10793 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 10794 xn = desc & (1 << 15); 10795 *page_size = 0x10000; 10796 break; 10797 case 2: case 3: /* 4k page. */ 10798 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10799 xn = desc & 1; 10800 *page_size = 0x1000; 10801 break; 10802 default: 10803 /* Never happens, but compiler isn't smart enough to tell. */ 10804 abort(); 10805 } 10806 } 10807 if (domain_prot == 3) { 10808 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10809 } else { 10810 if (pxn && !regime_is_user(env, mmu_idx)) { 10811 xn = 1; 10812 } 10813 if (xn && access_type == MMU_INST_FETCH) { 10814 fi->type = ARMFault_Permission; 10815 goto do_fault; 10816 } 10817 10818 if (arm_feature(env, ARM_FEATURE_V6K) && 10819 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 10820 /* The simplified model uses AP[0] as an access control bit. */ 10821 if ((ap & 1) == 0) { 10822 /* Access flag fault. */ 10823 fi->type = ARMFault_AccessFlag; 10824 goto do_fault; 10825 } 10826 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 10827 } else { 10828 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 10829 } 10830 if (*prot && !xn) { 10831 *prot |= PAGE_EXEC; 10832 } 10833 if (!(*prot & (1 << access_type))) { 10834 /* Access permission fault. */ 10835 fi->type = ARMFault_Permission; 10836 goto do_fault; 10837 } 10838 } 10839 if (ns) { 10840 /* The NS bit will (as required by the architecture) have no effect if 10841 * the CPU doesn't support TZ or this is a non-secure translation 10842 * regime, because the attribute will already be non-secure. 10843 */ 10844 attrs->secure = false; 10845 } 10846 *phys_ptr = phys_addr; 10847 return false; 10848 do_fault: 10849 fi->domain = domain; 10850 fi->level = level; 10851 return true; 10852 } 10853 10854 /* 10855 * check_s2_mmu_setup 10856 * @cpu: ARMCPU 10857 * @is_aa64: True if the translation regime is in AArch64 state 10858 * @startlevel: Suggested starting level 10859 * @inputsize: Bitsize of IPAs 10860 * @stride: Page-table stride (See the ARM ARM) 10861 * 10862 * Returns true if the suggested S2 translation parameters are OK and 10863 * false otherwise. 10864 */ 10865 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, 10866 int inputsize, int stride) 10867 { 10868 const int grainsize = stride + 3; 10869 int startsizecheck; 10870 10871 /* Negative levels are never allowed. */ 10872 if (level < 0) { 10873 return false; 10874 } 10875 10876 startsizecheck = inputsize - ((3 - level) * stride + grainsize); 10877 if (startsizecheck < 1 || startsizecheck > stride + 4) { 10878 return false; 10879 } 10880 10881 if (is_aa64) { 10882 CPUARMState *env = &cpu->env; 10883 unsigned int pamax = arm_pamax(cpu); 10884 10885 switch (stride) { 10886 case 13: /* 64KB Pages. */ 10887 if (level == 0 || (level == 1 && pamax <= 42)) { 10888 return false; 10889 } 10890 break; 10891 case 11: /* 16KB Pages. */ 10892 if (level == 0 || (level == 1 && pamax <= 40)) { 10893 return false; 10894 } 10895 break; 10896 case 9: /* 4KB Pages. */ 10897 if (level == 0 && pamax <= 42) { 10898 return false; 10899 } 10900 break; 10901 default: 10902 g_assert_not_reached(); 10903 } 10904 10905 /* Inputsize checks. */ 10906 if (inputsize > pamax && 10907 (arm_el_is_aa64(env, 1) || inputsize > 40)) { 10908 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */ 10909 return false; 10910 } 10911 } else { 10912 /* AArch32 only supports 4KB pages. Assert on that. */ 10913 assert(stride == 9); 10914 10915 if (level == 0) { 10916 return false; 10917 } 10918 } 10919 return true; 10920 } 10921 10922 /* Translate from the 4-bit stage 2 representation of 10923 * memory attributes (without cache-allocation hints) to 10924 * the 8-bit representation of the stage 1 MAIR registers 10925 * (which includes allocation hints). 10926 * 10927 * ref: shared/translation/attrs/S2AttrDecode() 10928 * .../S2ConvertAttrsHints() 10929 */ 10930 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs) 10931 { 10932 uint8_t hiattr = extract32(s2attrs, 2, 2); 10933 uint8_t loattr = extract32(s2attrs, 0, 2); 10934 uint8_t hihint = 0, lohint = 0; 10935 10936 if (hiattr != 0) { /* normal memory */ 10937 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */ 10938 hiattr = loattr = 1; /* non-cacheable */ 10939 } else { 10940 if (hiattr != 1) { /* Write-through or write-back */ 10941 hihint = 3; /* RW allocate */ 10942 } 10943 if (loattr != 1) { /* Write-through or write-back */ 10944 lohint = 3; /* RW allocate */ 10945 } 10946 } 10947 } 10948 10949 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 10950 } 10951 #endif /* !CONFIG_USER_ONLY */ 10952 10953 ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va, 10954 ARMMMUIdx mmu_idx) 10955 { 10956 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10957 uint32_t el = regime_el(env, mmu_idx); 10958 bool tbi, tbid, epd, hpd, using16k, using64k; 10959 int select, tsz; 10960 10961 /* 10962 * Bit 55 is always between the two regions, and is canonical for 10963 * determining if address tagging is enabled. 10964 */ 10965 select = extract64(va, 55, 1); 10966 10967 if (el > 1) { 10968 tsz = extract32(tcr, 0, 6); 10969 using64k = extract32(tcr, 14, 1); 10970 using16k = extract32(tcr, 15, 1); 10971 if (mmu_idx == ARMMMUIdx_S2NS) { 10972 /* VTCR_EL2 */ 10973 tbi = tbid = hpd = false; 10974 } else { 10975 tbi = extract32(tcr, 20, 1); 10976 hpd = extract32(tcr, 24, 1); 10977 tbid = extract32(tcr, 29, 1); 10978 } 10979 epd = false; 10980 } else if (!select) { 10981 tsz = extract32(tcr, 0, 6); 10982 epd = extract32(tcr, 7, 1); 10983 using64k = extract32(tcr, 14, 1); 10984 using16k = extract32(tcr, 15, 1); 10985 tbi = extract64(tcr, 37, 1); 10986 hpd = extract64(tcr, 41, 1); 10987 tbid = extract64(tcr, 51, 1); 10988 } else { 10989 int tg = extract32(tcr, 30, 2); 10990 using16k = tg == 1; 10991 using64k = tg == 3; 10992 tsz = extract32(tcr, 16, 6); 10993 epd = extract32(tcr, 23, 1); 10994 tbi = extract64(tcr, 38, 1); 10995 hpd = extract64(tcr, 42, 1); 10996 tbid = extract64(tcr, 52, 1); 10997 } 10998 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */ 10999 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */ 11000 11001 return (ARMVAParameters) { 11002 .tsz = tsz, 11003 .select = select, 11004 .tbi = tbi, 11005 .tbid = tbid, 11006 .epd = epd, 11007 .hpd = hpd, 11008 .using16k = using16k, 11009 .using64k = using64k, 11010 }; 11011 } 11012 11013 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 11014 ARMMMUIdx mmu_idx, bool data) 11015 { 11016 ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx); 11017 11018 /* Present TBI as a composite with TBID. */ 11019 ret.tbi &= (data || !ret.tbid); 11020 return ret; 11021 } 11022 11023 #ifndef CONFIG_USER_ONLY 11024 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 11025 ARMMMUIdx mmu_idx) 11026 { 11027 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 11028 uint32_t el = regime_el(env, mmu_idx); 11029 int select, tsz; 11030 bool epd, hpd; 11031 11032 if (mmu_idx == ARMMMUIdx_S2NS) { 11033 /* VTCR */ 11034 bool sext = extract32(tcr, 4, 1); 11035 bool sign = extract32(tcr, 3, 1); 11036 11037 /* 11038 * If the sign-extend bit is not the same as t0sz[3], the result 11039 * is unpredictable. Flag this as a guest error. 11040 */ 11041 if (sign != sext) { 11042 qemu_log_mask(LOG_GUEST_ERROR, 11043 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 11044 } 11045 tsz = sextract32(tcr, 0, 4) + 8; 11046 select = 0; 11047 hpd = false; 11048 epd = false; 11049 } else if (el == 2) { 11050 /* HTCR */ 11051 tsz = extract32(tcr, 0, 3); 11052 select = 0; 11053 hpd = extract64(tcr, 24, 1); 11054 epd = false; 11055 } else { 11056 int t0sz = extract32(tcr, 0, 3); 11057 int t1sz = extract32(tcr, 16, 3); 11058 11059 if (t1sz == 0) { 11060 select = va > (0xffffffffu >> t0sz); 11061 } else { 11062 /* Note that we will detect errors later. */ 11063 select = va >= ~(0xffffffffu >> t1sz); 11064 } 11065 if (!select) { 11066 tsz = t0sz; 11067 epd = extract32(tcr, 7, 1); 11068 hpd = extract64(tcr, 41, 1); 11069 } else { 11070 tsz = t1sz; 11071 epd = extract32(tcr, 23, 1); 11072 hpd = extract64(tcr, 42, 1); 11073 } 11074 /* For aarch32, hpd0 is not enabled without t2e as well. */ 11075 hpd &= extract32(tcr, 6, 1); 11076 } 11077 11078 return (ARMVAParameters) { 11079 .tsz = tsz, 11080 .select = select, 11081 .epd = epd, 11082 .hpd = hpd, 11083 }; 11084 } 11085 11086 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 11087 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11088 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 11089 target_ulong *page_size_ptr, 11090 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 11091 { 11092 ARMCPU *cpu = arm_env_get_cpu(env); 11093 CPUState *cs = CPU(cpu); 11094 /* Read an LPAE long-descriptor translation table. */ 11095 ARMFaultType fault_type = ARMFault_Translation; 11096 uint32_t level; 11097 ARMVAParameters param; 11098 uint64_t ttbr; 11099 hwaddr descaddr, indexmask, indexmask_grainsize; 11100 uint32_t tableattrs; 11101 target_ulong page_size; 11102 uint32_t attrs; 11103 int32_t stride; 11104 int addrsize, inputsize; 11105 TCR *tcr = regime_tcr(env, mmu_idx); 11106 int ap, ns, xn, pxn; 11107 uint32_t el = regime_el(env, mmu_idx); 11108 bool ttbr1_valid; 11109 uint64_t descaddrmask; 11110 bool aarch64 = arm_el_is_aa64(env, el); 11111 bool guarded = false; 11112 11113 /* TODO: 11114 * This code does not handle the different format TCR for VTCR_EL2. 11115 * This code also does not support shareability levels. 11116 * Attribute and permission bit handling should also be checked when adding 11117 * support for those page table walks. 11118 */ 11119 if (aarch64) { 11120 param = aa64_va_parameters(env, address, mmu_idx, 11121 access_type != MMU_INST_FETCH); 11122 level = 0; 11123 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it 11124 * invalid. 11125 */ 11126 ttbr1_valid = (el < 2); 11127 addrsize = 64 - 8 * param.tbi; 11128 inputsize = 64 - param.tsz; 11129 } else { 11130 param = aa32_va_parameters(env, address, mmu_idx); 11131 level = 1; 11132 /* There is no TTBR1 for EL2 */ 11133 ttbr1_valid = (el != 2); 11134 addrsize = (mmu_idx == ARMMMUIdx_S2NS ? 40 : 32); 11135 inputsize = addrsize - param.tsz; 11136 } 11137 11138 /* 11139 * We determined the region when collecting the parameters, but we 11140 * have not yet validated that the address is valid for the region. 11141 * Extract the top bits and verify that they all match select. 11142 * 11143 * For aa32, if inputsize == addrsize, then we have selected the 11144 * region by exclusion in aa32_va_parameters and there is no more 11145 * validation to do here. 11146 */ 11147 if (inputsize < addrsize) { 11148 target_ulong top_bits = sextract64(address, inputsize, 11149 addrsize - inputsize); 11150 if (-top_bits != param.select || (param.select && !ttbr1_valid)) { 11151 /* The gap between the two regions is a Translation fault */ 11152 fault_type = ARMFault_Translation; 11153 goto do_fault; 11154 } 11155 } 11156 11157 if (param.using64k) { 11158 stride = 13; 11159 } else if (param.using16k) { 11160 stride = 11; 11161 } else { 11162 stride = 9; 11163 } 11164 11165 /* Note that QEMU ignores shareability and cacheability attributes, 11166 * so we don't need to do anything with the SH, ORGN, IRGN fields 11167 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 11168 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 11169 * implement any ASID-like capability so we can ignore it (instead 11170 * we will always flush the TLB any time the ASID is changed). 11171 */ 11172 ttbr = regime_ttbr(env, mmu_idx, param.select); 11173 11174 /* Here we should have set up all the parameters for the translation: 11175 * inputsize, ttbr, epd, stride, tbi 11176 */ 11177 11178 if (param.epd) { 11179 /* Translation table walk disabled => Translation fault on TLB miss 11180 * Note: This is always 0 on 64-bit EL2 and EL3. 11181 */ 11182 goto do_fault; 11183 } 11184 11185 if (mmu_idx != ARMMMUIdx_S2NS) { 11186 /* The starting level depends on the virtual address size (which can 11187 * be up to 48 bits) and the translation granule size. It indicates 11188 * the number of strides (stride bits at a time) needed to 11189 * consume the bits of the input address. In the pseudocode this is: 11190 * level = 4 - RoundUp((inputsize - grainsize) / stride) 11191 * where their 'inputsize' is our 'inputsize', 'grainsize' is 11192 * our 'stride + 3' and 'stride' is our 'stride'. 11193 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 11194 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 11195 * = 4 - (inputsize - 4) / stride; 11196 */ 11197 level = 4 - (inputsize - 4) / stride; 11198 } else { 11199 /* For stage 2 translations the starting level is specified by the 11200 * VTCR_EL2.SL0 field (whose interpretation depends on the page size) 11201 */ 11202 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2); 11203 uint32_t startlevel; 11204 bool ok; 11205 11206 if (!aarch64 || stride == 9) { 11207 /* AArch32 or 4KB pages */ 11208 startlevel = 2 - sl0; 11209 } else { 11210 /* 16KB or 64KB pages */ 11211 startlevel = 3 - sl0; 11212 } 11213 11214 /* Check that the starting level is valid. */ 11215 ok = check_s2_mmu_setup(cpu, aarch64, startlevel, 11216 inputsize, stride); 11217 if (!ok) { 11218 fault_type = ARMFault_Translation; 11219 goto do_fault; 11220 } 11221 level = startlevel; 11222 } 11223 11224 indexmask_grainsize = (1ULL << (stride + 3)) - 1; 11225 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1; 11226 11227 /* Now we can extract the actual base address from the TTBR */ 11228 descaddr = extract64(ttbr, 0, 48); 11229 descaddr &= ~indexmask; 11230 11231 /* The address field in the descriptor goes up to bit 39 for ARMv7 11232 * but up to bit 47 for ARMv8, but we use the descaddrmask 11233 * up to bit 39 for AArch32, because we don't need other bits in that case 11234 * to construct next descriptor address (anyway they should be all zeroes). 11235 */ 11236 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) & 11237 ~indexmask_grainsize; 11238 11239 /* Secure accesses start with the page table in secure memory and 11240 * can be downgraded to non-secure at any step. Non-secure accesses 11241 * remain non-secure. We implement this by just ORing in the NSTable/NS 11242 * bits at each step. 11243 */ 11244 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4); 11245 for (;;) { 11246 uint64_t descriptor; 11247 bool nstable; 11248 11249 descaddr |= (address >> (stride * (4 - level))) & indexmask; 11250 descaddr &= ~7ULL; 11251 nstable = extract32(tableattrs, 4, 1); 11252 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi); 11253 if (fi->type != ARMFault_None) { 11254 goto do_fault; 11255 } 11256 11257 if (!(descriptor & 1) || 11258 (!(descriptor & 2) && (level == 3))) { 11259 /* Invalid, or the Reserved level 3 encoding */ 11260 goto do_fault; 11261 } 11262 descaddr = descriptor & descaddrmask; 11263 11264 if ((descriptor & 2) && (level < 3)) { 11265 /* Table entry. The top five bits are attributes which may 11266 * propagate down through lower levels of the table (and 11267 * which are all arranged so that 0 means "no effect", so 11268 * we can gather them up by ORing in the bits at each level). 11269 */ 11270 tableattrs |= extract64(descriptor, 59, 5); 11271 level++; 11272 indexmask = indexmask_grainsize; 11273 continue; 11274 } 11275 /* Block entry at level 1 or 2, or page entry at level 3. 11276 * These are basically the same thing, although the number 11277 * of bits we pull in from the vaddr varies. 11278 */ 11279 page_size = (1ULL << ((stride * (4 - level)) + 3)); 11280 descaddr |= (address & (page_size - 1)); 11281 /* Extract attributes from the descriptor */ 11282 attrs = extract64(descriptor, 2, 10) 11283 | (extract64(descriptor, 52, 12) << 10); 11284 11285 if (mmu_idx == ARMMMUIdx_S2NS) { 11286 /* Stage 2 table descriptors do not include any attribute fields */ 11287 break; 11288 } 11289 /* Merge in attributes from table descriptors */ 11290 attrs |= nstable << 3; /* NS */ 11291 guarded = extract64(descriptor, 50, 1); /* GP */ 11292 if (param.hpd) { 11293 /* HPD disables all the table attributes except NSTable. */ 11294 break; 11295 } 11296 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */ 11297 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 11298 * means "force PL1 access only", which means forcing AP[1] to 0. 11299 */ 11300 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */ 11301 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */ 11302 break; 11303 } 11304 /* Here descaddr is the final physical address, and attributes 11305 * are all in attrs. 11306 */ 11307 fault_type = ARMFault_AccessFlag; 11308 if ((attrs & (1 << 8)) == 0) { 11309 /* Access flag */ 11310 goto do_fault; 11311 } 11312 11313 ap = extract32(attrs, 4, 2); 11314 xn = extract32(attrs, 12, 1); 11315 11316 if (mmu_idx == ARMMMUIdx_S2NS) { 11317 ns = true; 11318 *prot = get_S2prot(env, ap, xn); 11319 } else { 11320 ns = extract32(attrs, 3, 1); 11321 pxn = extract32(attrs, 11, 1); 11322 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 11323 } 11324 11325 fault_type = ARMFault_Permission; 11326 if (!(*prot & (1 << access_type))) { 11327 goto do_fault; 11328 } 11329 11330 if (ns) { 11331 /* The NS bit will (as required by the architecture) have no effect if 11332 * the CPU doesn't support TZ or this is a non-secure translation 11333 * regime, because the attribute will already be non-secure. 11334 */ 11335 txattrs->secure = false; 11336 } 11337 /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB. */ 11338 if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) { 11339 txattrs->target_tlb_bit0 = true; 11340 } 11341 11342 if (cacheattrs != NULL) { 11343 if (mmu_idx == ARMMMUIdx_S2NS) { 11344 cacheattrs->attrs = convert_stage2_attrs(env, 11345 extract32(attrs, 0, 4)); 11346 } else { 11347 /* Index into MAIR registers for cache attributes */ 11348 uint8_t attrindx = extract32(attrs, 0, 3); 11349 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 11350 assert(attrindx <= 7); 11351 cacheattrs->attrs = extract64(mair, attrindx * 8, 8); 11352 } 11353 cacheattrs->shareability = extract32(attrs, 6, 2); 11354 } 11355 11356 *phys_ptr = descaddr; 11357 *page_size_ptr = page_size; 11358 return false; 11359 11360 do_fault: 11361 fi->type = fault_type; 11362 fi->level = level; 11363 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 11364 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS); 11365 return true; 11366 } 11367 11368 static inline void get_phys_addr_pmsav7_default(CPUARMState *env, 11369 ARMMMUIdx mmu_idx, 11370 int32_t address, int *prot) 11371 { 11372 if (!arm_feature(env, ARM_FEATURE_M)) { 11373 *prot = PAGE_READ | PAGE_WRITE; 11374 switch (address) { 11375 case 0xF0000000 ... 0xFFFFFFFF: 11376 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 11377 /* hivecs execing is ok */ 11378 *prot |= PAGE_EXEC; 11379 } 11380 break; 11381 case 0x00000000 ... 0x7FFFFFFF: 11382 *prot |= PAGE_EXEC; 11383 break; 11384 } 11385 } else { 11386 /* Default system address map for M profile cores. 11387 * The architecture specifies which regions are execute-never; 11388 * at the MPU level no other checks are defined. 11389 */ 11390 switch (address) { 11391 case 0x00000000 ... 0x1fffffff: /* ROM */ 11392 case 0x20000000 ... 0x3fffffff: /* SRAM */ 11393 case 0x60000000 ... 0x7fffffff: /* RAM */ 11394 case 0x80000000 ... 0x9fffffff: /* RAM */ 11395 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11396 break; 11397 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 11398 case 0xa0000000 ... 0xbfffffff: /* Device */ 11399 case 0xc0000000 ... 0xdfffffff: /* Device */ 11400 case 0xe0000000 ... 0xffffffff: /* System */ 11401 *prot = PAGE_READ | PAGE_WRITE; 11402 break; 11403 default: 11404 g_assert_not_reached(); 11405 } 11406 } 11407 } 11408 11409 static bool pmsav7_use_background_region(ARMCPU *cpu, 11410 ARMMMUIdx mmu_idx, bool is_user) 11411 { 11412 /* Return true if we should use the default memory map as a 11413 * "background" region if there are no hits against any MPU regions. 11414 */ 11415 CPUARMState *env = &cpu->env; 11416 11417 if (is_user) { 11418 return false; 11419 } 11420 11421 if (arm_feature(env, ARM_FEATURE_M)) { 11422 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] 11423 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 11424 } else { 11425 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 11426 } 11427 } 11428 11429 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address) 11430 { 11431 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 11432 return arm_feature(env, ARM_FEATURE_M) && 11433 extract32(address, 20, 12) == 0xe00; 11434 } 11435 11436 static inline bool m_is_system_region(CPUARMState *env, uint32_t address) 11437 { 11438 /* True if address is in the M profile system region 11439 * 0xe0000000 - 0xffffffff 11440 */ 11441 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 11442 } 11443 11444 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 11445 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11446 hwaddr *phys_ptr, int *prot, 11447 target_ulong *page_size, 11448 ARMMMUFaultInfo *fi) 11449 { 11450 ARMCPU *cpu = arm_env_get_cpu(env); 11451 int n; 11452 bool is_user = regime_is_user(env, mmu_idx); 11453 11454 *phys_ptr = address; 11455 *page_size = TARGET_PAGE_SIZE; 11456 *prot = 0; 11457 11458 if (regime_translation_disabled(env, mmu_idx) || 11459 m_is_ppb_region(env, address)) { 11460 /* MPU disabled or M profile PPB access: use default memory map. 11461 * The other case which uses the default memory map in the 11462 * v7M ARM ARM pseudocode is exception vector reads from the vector 11463 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 11464 * which always does a direct read using address_space_ldl(), rather 11465 * than going via this function, so we don't need to check that here. 11466 */ 11467 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11468 } else { /* MPU enabled */ 11469 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 11470 /* region search */ 11471 uint32_t base = env->pmsav7.drbar[n]; 11472 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 11473 uint32_t rmask; 11474 bool srdis = false; 11475 11476 if (!(env->pmsav7.drsr[n] & 0x1)) { 11477 continue; 11478 } 11479 11480 if (!rsize) { 11481 qemu_log_mask(LOG_GUEST_ERROR, 11482 "DRSR[%d]: Rsize field cannot be 0\n", n); 11483 continue; 11484 } 11485 rsize++; 11486 rmask = (1ull << rsize) - 1; 11487 11488 if (base & rmask) { 11489 qemu_log_mask(LOG_GUEST_ERROR, 11490 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 11491 "to DRSR region size, mask = 0x%" PRIx32 "\n", 11492 n, base, rmask); 11493 continue; 11494 } 11495 11496 if (address < base || address > base + rmask) { 11497 /* 11498 * Address not in this region. We must check whether the 11499 * region covers addresses in the same page as our address. 11500 * In that case we must not report a size that covers the 11501 * whole page for a subsequent hit against a different MPU 11502 * region or the background region, because it would result in 11503 * incorrect TLB hits for subsequent accesses to addresses that 11504 * are in this MPU region. 11505 */ 11506 if (ranges_overlap(base, rmask, 11507 address & TARGET_PAGE_MASK, 11508 TARGET_PAGE_SIZE)) { 11509 *page_size = 1; 11510 } 11511 continue; 11512 } 11513 11514 /* Region matched */ 11515 11516 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 11517 int i, snd; 11518 uint32_t srdis_mask; 11519 11520 rsize -= 3; /* sub region size (power of 2) */ 11521 snd = ((address - base) >> rsize) & 0x7; 11522 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 11523 11524 srdis_mask = srdis ? 0x3 : 0x0; 11525 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 11526 /* This will check in groups of 2, 4 and then 8, whether 11527 * the subregion bits are consistent. rsize is incremented 11528 * back up to give the region size, considering consistent 11529 * adjacent subregions as one region. Stop testing if rsize 11530 * is already big enough for an entire QEMU page. 11531 */ 11532 int snd_rounded = snd & ~(i - 1); 11533 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 11534 snd_rounded + 8, i); 11535 if (srdis_mask ^ srdis_multi) { 11536 break; 11537 } 11538 srdis_mask = (srdis_mask << i) | srdis_mask; 11539 rsize++; 11540 } 11541 } 11542 if (srdis) { 11543 continue; 11544 } 11545 if (rsize < TARGET_PAGE_BITS) { 11546 *page_size = 1 << rsize; 11547 } 11548 break; 11549 } 11550 11551 if (n == -1) { /* no hits */ 11552 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 11553 /* background fault */ 11554 fi->type = ARMFault_Background; 11555 return true; 11556 } 11557 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11558 } else { /* a MPU hit! */ 11559 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 11560 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 11561 11562 if (m_is_system_region(env, address)) { 11563 /* System space is always execute never */ 11564 xn = 1; 11565 } 11566 11567 if (is_user) { /* User mode AP bit decoding */ 11568 switch (ap) { 11569 case 0: 11570 case 1: 11571 case 5: 11572 break; /* no access */ 11573 case 3: 11574 *prot |= PAGE_WRITE; 11575 /* fall through */ 11576 case 2: 11577 case 6: 11578 *prot |= PAGE_READ | PAGE_EXEC; 11579 break; 11580 case 7: 11581 /* for v7M, same as 6; for R profile a reserved value */ 11582 if (arm_feature(env, ARM_FEATURE_M)) { 11583 *prot |= PAGE_READ | PAGE_EXEC; 11584 break; 11585 } 11586 /* fall through */ 11587 default: 11588 qemu_log_mask(LOG_GUEST_ERROR, 11589 "DRACR[%d]: Bad value for AP bits: 0x%" 11590 PRIx32 "\n", n, ap); 11591 } 11592 } else { /* Priv. mode AP bits decoding */ 11593 switch (ap) { 11594 case 0: 11595 break; /* no access */ 11596 case 1: 11597 case 2: 11598 case 3: 11599 *prot |= PAGE_WRITE; 11600 /* fall through */ 11601 case 5: 11602 case 6: 11603 *prot |= PAGE_READ | PAGE_EXEC; 11604 break; 11605 case 7: 11606 /* for v7M, same as 6; for R profile a reserved value */ 11607 if (arm_feature(env, ARM_FEATURE_M)) { 11608 *prot |= PAGE_READ | PAGE_EXEC; 11609 break; 11610 } 11611 /* fall through */ 11612 default: 11613 qemu_log_mask(LOG_GUEST_ERROR, 11614 "DRACR[%d]: Bad value for AP bits: 0x%" 11615 PRIx32 "\n", n, ap); 11616 } 11617 } 11618 11619 /* execute never */ 11620 if (xn) { 11621 *prot &= ~PAGE_EXEC; 11622 } 11623 } 11624 } 11625 11626 fi->type = ARMFault_Permission; 11627 fi->level = 1; 11628 return !(*prot & (1 << access_type)); 11629 } 11630 11631 static bool v8m_is_sau_exempt(CPUARMState *env, 11632 uint32_t address, MMUAccessType access_type) 11633 { 11634 /* The architecture specifies that certain address ranges are 11635 * exempt from v8M SAU/IDAU checks. 11636 */ 11637 return 11638 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 11639 (address >= 0xe0000000 && address <= 0xe0002fff) || 11640 (address >= 0xe000e000 && address <= 0xe000efff) || 11641 (address >= 0xe002e000 && address <= 0xe002efff) || 11642 (address >= 0xe0040000 && address <= 0xe0041fff) || 11643 (address >= 0xe00ff000 && address <= 0xe00fffff); 11644 } 11645 11646 static void v8m_security_lookup(CPUARMState *env, uint32_t address, 11647 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11648 V8M_SAttributes *sattrs) 11649 { 11650 /* Look up the security attributes for this address. Compare the 11651 * pseudocode SecurityCheck() function. 11652 * We assume the caller has zero-initialized *sattrs. 11653 */ 11654 ARMCPU *cpu = arm_env_get_cpu(env); 11655 int r; 11656 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 11657 int idau_region = IREGION_NOTVALID; 11658 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 11659 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 11660 11661 if (cpu->idau) { 11662 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 11663 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 11664 11665 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 11666 &idau_nsc); 11667 } 11668 11669 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 11670 /* 0xf0000000..0xffffffff is always S for insn fetches */ 11671 return; 11672 } 11673 11674 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 11675 sattrs->ns = !regime_is_secure(env, mmu_idx); 11676 return; 11677 } 11678 11679 if (idau_region != IREGION_NOTVALID) { 11680 sattrs->irvalid = true; 11681 sattrs->iregion = idau_region; 11682 } 11683 11684 switch (env->sau.ctrl & 3) { 11685 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 11686 break; 11687 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 11688 sattrs->ns = true; 11689 break; 11690 default: /* SAU.ENABLE == 1 */ 11691 for (r = 0; r < cpu->sau_sregion; r++) { 11692 if (env->sau.rlar[r] & 1) { 11693 uint32_t base = env->sau.rbar[r] & ~0x1f; 11694 uint32_t limit = env->sau.rlar[r] | 0x1f; 11695 11696 if (base <= address && limit >= address) { 11697 if (base > addr_page_base || limit < addr_page_limit) { 11698 sattrs->subpage = true; 11699 } 11700 if (sattrs->srvalid) { 11701 /* If we hit in more than one region then we must report 11702 * as Secure, not NS-Callable, with no valid region 11703 * number info. 11704 */ 11705 sattrs->ns = false; 11706 sattrs->nsc = false; 11707 sattrs->sregion = 0; 11708 sattrs->srvalid = false; 11709 break; 11710 } else { 11711 if (env->sau.rlar[r] & 2) { 11712 sattrs->nsc = true; 11713 } else { 11714 sattrs->ns = true; 11715 } 11716 sattrs->srvalid = true; 11717 sattrs->sregion = r; 11718 } 11719 } else { 11720 /* 11721 * Address not in this region. We must check whether the 11722 * region covers addresses in the same page as our address. 11723 * In that case we must not report a size that covers the 11724 * whole page for a subsequent hit against a different MPU 11725 * region or the background region, because it would result 11726 * in incorrect TLB hits for subsequent accesses to 11727 * addresses that are in this MPU region. 11728 */ 11729 if (limit >= base && 11730 ranges_overlap(base, limit - base + 1, 11731 addr_page_base, 11732 TARGET_PAGE_SIZE)) { 11733 sattrs->subpage = true; 11734 } 11735 } 11736 } 11737 } 11738 break; 11739 } 11740 11741 /* 11742 * The IDAU will override the SAU lookup results if it specifies 11743 * higher security than the SAU does. 11744 */ 11745 if (!idau_ns) { 11746 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 11747 sattrs->ns = false; 11748 sattrs->nsc = idau_nsc; 11749 } 11750 } 11751 } 11752 11753 static bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 11754 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11755 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11756 int *prot, bool *is_subpage, 11757 ARMMMUFaultInfo *fi, uint32_t *mregion) 11758 { 11759 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check 11760 * that a full phys-to-virt translation does). 11761 * mregion is (if not NULL) set to the region number which matched, 11762 * or -1 if no region number is returned (MPU off, address did not 11763 * hit a region, address hit in multiple regions). 11764 * We set is_subpage to true if the region hit doesn't cover the 11765 * entire TARGET_PAGE the address is within. 11766 */ 11767 ARMCPU *cpu = arm_env_get_cpu(env); 11768 bool is_user = regime_is_user(env, mmu_idx); 11769 uint32_t secure = regime_is_secure(env, mmu_idx); 11770 int n; 11771 int matchregion = -1; 11772 bool hit = false; 11773 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 11774 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 11775 11776 *is_subpage = false; 11777 *phys_ptr = address; 11778 *prot = 0; 11779 if (mregion) { 11780 *mregion = -1; 11781 } 11782 11783 /* Unlike the ARM ARM pseudocode, we don't need to check whether this 11784 * was an exception vector read from the vector table (which is always 11785 * done using the default system address map), because those accesses 11786 * are done in arm_v7m_load_vector(), which always does a direct 11787 * read using address_space_ldl(), rather than going via this function. 11788 */ 11789 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */ 11790 hit = true; 11791 } else if (m_is_ppb_region(env, address)) { 11792 hit = true; 11793 } else { 11794 if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 11795 hit = true; 11796 } 11797 11798 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 11799 /* region search */ 11800 /* Note that the base address is bits [31:5] from the register 11801 * with bits [4:0] all zeroes, but the limit address is bits 11802 * [31:5] from the register with bits [4:0] all ones. 11803 */ 11804 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f; 11805 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f; 11806 11807 if (!(env->pmsav8.rlar[secure][n] & 0x1)) { 11808 /* Region disabled */ 11809 continue; 11810 } 11811 11812 if (address < base || address > limit) { 11813 /* 11814 * Address not in this region. We must check whether the 11815 * region covers addresses in the same page as our address. 11816 * In that case we must not report a size that covers the 11817 * whole page for a subsequent hit against a different MPU 11818 * region or the background region, because it would result in 11819 * incorrect TLB hits for subsequent accesses to addresses that 11820 * are in this MPU region. 11821 */ 11822 if (limit >= base && 11823 ranges_overlap(base, limit - base + 1, 11824 addr_page_base, 11825 TARGET_PAGE_SIZE)) { 11826 *is_subpage = true; 11827 } 11828 continue; 11829 } 11830 11831 if (base > addr_page_base || limit < addr_page_limit) { 11832 *is_subpage = true; 11833 } 11834 11835 if (matchregion != -1) { 11836 /* Multiple regions match -- always a failure (unlike 11837 * PMSAv7 where highest-numbered-region wins) 11838 */ 11839 fi->type = ARMFault_Permission; 11840 fi->level = 1; 11841 return true; 11842 } 11843 11844 matchregion = n; 11845 hit = true; 11846 } 11847 } 11848 11849 if (!hit) { 11850 /* background fault */ 11851 fi->type = ARMFault_Background; 11852 return true; 11853 } 11854 11855 if (matchregion == -1) { 11856 /* hit using the background region */ 11857 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11858 } else { 11859 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2); 11860 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1); 11861 11862 if (m_is_system_region(env, address)) { 11863 /* System space is always execute never */ 11864 xn = 1; 11865 } 11866 11867 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 11868 if (*prot && !xn) { 11869 *prot |= PAGE_EXEC; 11870 } 11871 /* We don't need to look the attribute up in the MAIR0/MAIR1 11872 * registers because that only tells us about cacheability. 11873 */ 11874 if (mregion) { 11875 *mregion = matchregion; 11876 } 11877 } 11878 11879 fi->type = ARMFault_Permission; 11880 fi->level = 1; 11881 return !(*prot & (1 << access_type)); 11882 } 11883 11884 11885 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 11886 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11887 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11888 int *prot, target_ulong *page_size, 11889 ARMMMUFaultInfo *fi) 11890 { 11891 uint32_t secure = regime_is_secure(env, mmu_idx); 11892 V8M_SAttributes sattrs = {}; 11893 bool ret; 11894 bool mpu_is_subpage; 11895 11896 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11897 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs); 11898 if (access_type == MMU_INST_FETCH) { 11899 /* Instruction fetches always use the MMU bank and the 11900 * transaction attribute determined by the fetch address, 11901 * regardless of CPU state. This is painful for QEMU 11902 * to handle, because it would mean we need to encode 11903 * into the mmu_idx not just the (user, negpri) information 11904 * for the current security state but also that for the 11905 * other security state, which would balloon the number 11906 * of mmu_idx values needed alarmingly. 11907 * Fortunately we can avoid this because it's not actually 11908 * possible to arbitrarily execute code from memory with 11909 * the wrong security attribute: it will always generate 11910 * an exception of some kind or another, apart from the 11911 * special case of an NS CPU executing an SG instruction 11912 * in S&NSC memory. So we always just fail the translation 11913 * here and sort things out in the exception handler 11914 * (including possibly emulating an SG instruction). 11915 */ 11916 if (sattrs.ns != !secure) { 11917 if (sattrs.nsc) { 11918 fi->type = ARMFault_QEMU_NSCExec; 11919 } else { 11920 fi->type = ARMFault_QEMU_SFault; 11921 } 11922 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11923 *phys_ptr = address; 11924 *prot = 0; 11925 return true; 11926 } 11927 } else { 11928 /* For data accesses we always use the MMU bank indicated 11929 * by the current CPU state, but the security attributes 11930 * might downgrade a secure access to nonsecure. 11931 */ 11932 if (sattrs.ns) { 11933 txattrs->secure = false; 11934 } else if (!secure) { 11935 /* NS access to S memory must fault. 11936 * Architecturally we should first check whether the 11937 * MPU information for this address indicates that we 11938 * are doing an unaligned access to Device memory, which 11939 * should generate a UsageFault instead. QEMU does not 11940 * currently check for that kind of unaligned access though. 11941 * If we added it we would need to do so as a special case 11942 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 11943 */ 11944 fi->type = ARMFault_QEMU_SFault; 11945 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11946 *phys_ptr = address; 11947 *prot = 0; 11948 return true; 11949 } 11950 } 11951 } 11952 11953 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr, 11954 txattrs, prot, &mpu_is_subpage, fi, NULL); 11955 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE; 11956 return ret; 11957 } 11958 11959 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 11960 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11961 hwaddr *phys_ptr, int *prot, 11962 ARMMMUFaultInfo *fi) 11963 { 11964 int n; 11965 uint32_t mask; 11966 uint32_t base; 11967 bool is_user = regime_is_user(env, mmu_idx); 11968 11969 if (regime_translation_disabled(env, mmu_idx)) { 11970 /* MPU disabled. */ 11971 *phys_ptr = address; 11972 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11973 return false; 11974 } 11975 11976 *phys_ptr = address; 11977 for (n = 7; n >= 0; n--) { 11978 base = env->cp15.c6_region[n]; 11979 if ((base & 1) == 0) { 11980 continue; 11981 } 11982 mask = 1 << ((base >> 1) & 0x1f); 11983 /* Keep this shift separate from the above to avoid an 11984 (undefined) << 32. */ 11985 mask = (mask << 1) - 1; 11986 if (((base ^ address) & ~mask) == 0) { 11987 break; 11988 } 11989 } 11990 if (n < 0) { 11991 fi->type = ARMFault_Background; 11992 return true; 11993 } 11994 11995 if (access_type == MMU_INST_FETCH) { 11996 mask = env->cp15.pmsav5_insn_ap; 11997 } else { 11998 mask = env->cp15.pmsav5_data_ap; 11999 } 12000 mask = (mask >> (n * 4)) & 0xf; 12001 switch (mask) { 12002 case 0: 12003 fi->type = ARMFault_Permission; 12004 fi->level = 1; 12005 return true; 12006 case 1: 12007 if (is_user) { 12008 fi->type = ARMFault_Permission; 12009 fi->level = 1; 12010 return true; 12011 } 12012 *prot = PAGE_READ | PAGE_WRITE; 12013 break; 12014 case 2: 12015 *prot = PAGE_READ; 12016 if (!is_user) { 12017 *prot |= PAGE_WRITE; 12018 } 12019 break; 12020 case 3: 12021 *prot = PAGE_READ | PAGE_WRITE; 12022 break; 12023 case 5: 12024 if (is_user) { 12025 fi->type = ARMFault_Permission; 12026 fi->level = 1; 12027 return true; 12028 } 12029 *prot = PAGE_READ; 12030 break; 12031 case 6: 12032 *prot = PAGE_READ; 12033 break; 12034 default: 12035 /* Bad permission. */ 12036 fi->type = ARMFault_Permission; 12037 fi->level = 1; 12038 return true; 12039 } 12040 *prot |= PAGE_EXEC; 12041 return false; 12042 } 12043 12044 /* Combine either inner or outer cacheability attributes for normal 12045 * memory, according to table D4-42 and pseudocode procedure 12046 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 12047 * 12048 * NB: only stage 1 includes allocation hints (RW bits), leading to 12049 * some asymmetry. 12050 */ 12051 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 12052 { 12053 if (s1 == 4 || s2 == 4) { 12054 /* non-cacheable has precedence */ 12055 return 4; 12056 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 12057 /* stage 1 write-through takes precedence */ 12058 return s1; 12059 } else if (extract32(s2, 2, 2) == 2) { 12060 /* stage 2 write-through takes precedence, but the allocation hint 12061 * is still taken from stage 1 12062 */ 12063 return (2 << 2) | extract32(s1, 0, 2); 12064 } else { /* write-back */ 12065 return s1; 12066 } 12067 } 12068 12069 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 12070 * and CombineS1S2Desc() 12071 * 12072 * @s1: Attributes from stage 1 walk 12073 * @s2: Attributes from stage 2 walk 12074 */ 12075 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2) 12076 { 12077 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4); 12078 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4); 12079 ARMCacheAttrs ret; 12080 12081 /* Combine shareability attributes (table D4-43) */ 12082 if (s1.shareability == 2 || s2.shareability == 2) { 12083 /* if either are outer-shareable, the result is outer-shareable */ 12084 ret.shareability = 2; 12085 } else if (s1.shareability == 3 || s2.shareability == 3) { 12086 /* if either are inner-shareable, the result is inner-shareable */ 12087 ret.shareability = 3; 12088 } else { 12089 /* both non-shareable */ 12090 ret.shareability = 0; 12091 } 12092 12093 /* Combine memory type and cacheability attributes */ 12094 if (s1hi == 0 || s2hi == 0) { 12095 /* Device has precedence over normal */ 12096 if (s1lo == 0 || s2lo == 0) { 12097 /* nGnRnE has precedence over anything */ 12098 ret.attrs = 0; 12099 } else if (s1lo == 4 || s2lo == 4) { 12100 /* non-Reordering has precedence over Reordering */ 12101 ret.attrs = 4; /* nGnRE */ 12102 } else if (s1lo == 8 || s2lo == 8) { 12103 /* non-Gathering has precedence over Gathering */ 12104 ret.attrs = 8; /* nGRE */ 12105 } else { 12106 ret.attrs = 0xc; /* GRE */ 12107 } 12108 12109 /* Any location for which the resultant memory type is any 12110 * type of Device memory is always treated as Outer Shareable. 12111 */ 12112 ret.shareability = 2; 12113 } else { /* Normal memory */ 12114 /* Outer/inner cacheability combine independently */ 12115 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 12116 | combine_cacheattr_nibble(s1lo, s2lo); 12117 12118 if (ret.attrs == 0x44) { 12119 /* Any location for which the resultant memory type is Normal 12120 * Inner Non-cacheable, Outer Non-cacheable is always treated 12121 * as Outer Shareable. 12122 */ 12123 ret.shareability = 2; 12124 } 12125 } 12126 12127 return ret; 12128 } 12129 12130 12131 /* get_phys_addr - get the physical address for this virtual address 12132 * 12133 * Find the physical address corresponding to the given virtual address, 12134 * by doing a translation table walk on MMU based systems or using the 12135 * MPU state on MPU based systems. 12136 * 12137 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs, 12138 * prot and page_size may not be filled in, and the populated fsr value provides 12139 * information on why the translation aborted, in the format of a 12140 * DFSR/IFSR fault register, with the following caveats: 12141 * * we honour the short vs long DFSR format differences. 12142 * * the WnR bit is never set (the caller must do this). 12143 * * for PSMAv5 based systems we don't bother to return a full FSR format 12144 * value. 12145 * 12146 * @env: CPUARMState 12147 * @address: virtual address to get physical address for 12148 * @access_type: 0 for read, 1 for write, 2 for execute 12149 * @mmu_idx: MMU index indicating required translation regime 12150 * @phys_ptr: set to the physical address corresponding to the virtual address 12151 * @attrs: set to the memory transaction attributes to use 12152 * @prot: set to the permissions for the page containing phys_ptr 12153 * @page_size: set to the size of the page containing phys_ptr 12154 * @fi: set to fault info if the translation fails 12155 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes 12156 */ 12157 static bool get_phys_addr(CPUARMState *env, target_ulong address, 12158 MMUAccessType access_type, ARMMMUIdx mmu_idx, 12159 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 12160 target_ulong *page_size, 12161 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 12162 { 12163 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 12164 /* Call ourselves recursively to do the stage 1 and then stage 2 12165 * translations. 12166 */ 12167 if (arm_feature(env, ARM_FEATURE_EL2)) { 12168 hwaddr ipa; 12169 int s2_prot; 12170 int ret; 12171 ARMCacheAttrs cacheattrs2 = {}; 12172 12173 ret = get_phys_addr(env, address, access_type, 12174 stage_1_mmu_idx(mmu_idx), &ipa, attrs, 12175 prot, page_size, fi, cacheattrs); 12176 12177 /* If S1 fails or S2 is disabled, return early. */ 12178 if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 12179 *phys_ptr = ipa; 12180 return ret; 12181 } 12182 12183 /* S1 is done. Now do S2 translation. */ 12184 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS, 12185 phys_ptr, attrs, &s2_prot, 12186 page_size, fi, 12187 cacheattrs != NULL ? &cacheattrs2 : NULL); 12188 fi->s2addr = ipa; 12189 /* Combine the S1 and S2 perms. */ 12190 *prot &= s2_prot; 12191 12192 /* Combine the S1 and S2 cache attributes, if needed */ 12193 if (!ret && cacheattrs != NULL) { 12194 if (env->cp15.hcr_el2 & HCR_DC) { 12195 /* 12196 * HCR.DC forces the first stage attributes to 12197 * Normal Non-Shareable, 12198 * Inner Write-Back Read-Allocate Write-Allocate, 12199 * Outer Write-Back Read-Allocate Write-Allocate. 12200 */ 12201 cacheattrs->attrs = 0xff; 12202 cacheattrs->shareability = 0; 12203 } 12204 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2); 12205 } 12206 12207 return ret; 12208 } else { 12209 /* 12210 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1. 12211 */ 12212 mmu_idx = stage_1_mmu_idx(mmu_idx); 12213 } 12214 } 12215 12216 /* The page table entries may downgrade secure to non-secure, but 12217 * cannot upgrade an non-secure translation regime's attributes 12218 * to secure. 12219 */ 12220 attrs->secure = regime_is_secure(env, mmu_idx); 12221 attrs->user = regime_is_user(env, mmu_idx); 12222 12223 /* Fast Context Switch Extension. This doesn't exist at all in v8. 12224 * In v7 and earlier it affects all stage 1 translations. 12225 */ 12226 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS 12227 && !arm_feature(env, ARM_FEATURE_V8)) { 12228 if (regime_el(env, mmu_idx) == 3) { 12229 address += env->cp15.fcseidr_s; 12230 } else { 12231 address += env->cp15.fcseidr_ns; 12232 } 12233 } 12234 12235 if (arm_feature(env, ARM_FEATURE_PMSA)) { 12236 bool ret; 12237 *page_size = TARGET_PAGE_SIZE; 12238 12239 if (arm_feature(env, ARM_FEATURE_V8)) { 12240 /* PMSAv8 */ 12241 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 12242 phys_ptr, attrs, prot, page_size, fi); 12243 } else if (arm_feature(env, ARM_FEATURE_V7)) { 12244 /* PMSAv7 */ 12245 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 12246 phys_ptr, prot, page_size, fi); 12247 } else { 12248 /* Pre-v7 MPU */ 12249 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 12250 phys_ptr, prot, fi); 12251 } 12252 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 12253 " mmu_idx %u -> %s (prot %c%c%c)\n", 12254 access_type == MMU_DATA_LOAD ? "reading" : 12255 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 12256 (uint32_t)address, mmu_idx, 12257 ret ? "Miss" : "Hit", 12258 *prot & PAGE_READ ? 'r' : '-', 12259 *prot & PAGE_WRITE ? 'w' : '-', 12260 *prot & PAGE_EXEC ? 'x' : '-'); 12261 12262 return ret; 12263 } 12264 12265 /* Definitely a real MMU, not an MPU */ 12266 12267 if (regime_translation_disabled(env, mmu_idx)) { 12268 /* MMU disabled. */ 12269 *phys_ptr = address; 12270 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 12271 *page_size = TARGET_PAGE_SIZE; 12272 return 0; 12273 } 12274 12275 if (regime_using_lpae_format(env, mmu_idx)) { 12276 return get_phys_addr_lpae(env, address, access_type, mmu_idx, 12277 phys_ptr, attrs, prot, page_size, 12278 fi, cacheattrs); 12279 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) { 12280 return get_phys_addr_v6(env, address, access_type, mmu_idx, 12281 phys_ptr, attrs, prot, page_size, fi); 12282 } else { 12283 return get_phys_addr_v5(env, address, access_type, mmu_idx, 12284 phys_ptr, prot, page_size, fi); 12285 } 12286 } 12287 12288 /* Walk the page table and (if the mapping exists) add the page 12289 * to the TLB. Return false on success, or true on failure. Populate 12290 * fsr with ARM DFSR/IFSR fault register format value on failure. 12291 */ 12292 bool arm_tlb_fill(CPUState *cs, vaddr address, 12293 MMUAccessType access_type, int mmu_idx, 12294 ARMMMUFaultInfo *fi) 12295 { 12296 ARMCPU *cpu = ARM_CPU(cs); 12297 CPUARMState *env = &cpu->env; 12298 hwaddr phys_addr; 12299 target_ulong page_size; 12300 int prot; 12301 int ret; 12302 MemTxAttrs attrs = {}; 12303 12304 ret = get_phys_addr(env, address, access_type, 12305 core_to_arm_mmu_idx(env, mmu_idx), &phys_addr, 12306 &attrs, &prot, &page_size, fi, NULL); 12307 if (!ret) { 12308 /* 12309 * Map a single [sub]page. Regions smaller than our declared 12310 * target page size are handled specially, so for those we 12311 * pass in the exact addresses. 12312 */ 12313 if (page_size >= TARGET_PAGE_SIZE) { 12314 phys_addr &= TARGET_PAGE_MASK; 12315 address &= TARGET_PAGE_MASK; 12316 } 12317 tlb_set_page_with_attrs(cs, address, phys_addr, attrs, 12318 prot, mmu_idx, page_size); 12319 return 0; 12320 } 12321 12322 return ret; 12323 } 12324 12325 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 12326 MemTxAttrs *attrs) 12327 { 12328 ARMCPU *cpu = ARM_CPU(cs); 12329 CPUARMState *env = &cpu->env; 12330 hwaddr phys_addr; 12331 target_ulong page_size; 12332 int prot; 12333 bool ret; 12334 ARMMMUFaultInfo fi = {}; 12335 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 12336 12337 *attrs = (MemTxAttrs) {}; 12338 12339 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr, 12340 attrs, &prot, &page_size, &fi, NULL); 12341 12342 if (ret) { 12343 return -1; 12344 } 12345 return phys_addr; 12346 } 12347 12348 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) 12349 { 12350 uint32_t mask; 12351 unsigned el = arm_current_el(env); 12352 12353 /* First handle registers which unprivileged can read */ 12354 12355 switch (reg) { 12356 case 0 ... 7: /* xPSR sub-fields */ 12357 mask = 0; 12358 if ((reg & 1) && el) { 12359 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */ 12360 } 12361 if (!(reg & 4)) { 12362 mask |= XPSR_NZCV | XPSR_Q; /* APSR */ 12363 } 12364 /* EPSR reads as zero */ 12365 return xpsr_read(env) & mask; 12366 break; 12367 case 20: /* CONTROL */ 12368 { 12369 uint32_t value = env->v7m.control[env->v7m.secure]; 12370 if (!env->v7m.secure) { 12371 /* SFPA is RAZ/WI from NS; FPCA is stored in the M_REG_S bank */ 12372 value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK; 12373 } 12374 return value; 12375 } 12376 case 0x94: /* CONTROL_NS */ 12377 /* We have to handle this here because unprivileged Secure code 12378 * can read the NS CONTROL register. 12379 */ 12380 if (!env->v7m.secure) { 12381 return 0; 12382 } 12383 return env->v7m.control[M_REG_NS] | 12384 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK); 12385 } 12386 12387 if (el == 0) { 12388 return 0; /* unprivileged reads others as zero */ 12389 } 12390 12391 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 12392 switch (reg) { 12393 case 0x88: /* MSP_NS */ 12394 if (!env->v7m.secure) { 12395 return 0; 12396 } 12397 return env->v7m.other_ss_msp; 12398 case 0x89: /* PSP_NS */ 12399 if (!env->v7m.secure) { 12400 return 0; 12401 } 12402 return env->v7m.other_ss_psp; 12403 case 0x8a: /* MSPLIM_NS */ 12404 if (!env->v7m.secure) { 12405 return 0; 12406 } 12407 return env->v7m.msplim[M_REG_NS]; 12408 case 0x8b: /* PSPLIM_NS */ 12409 if (!env->v7m.secure) { 12410 return 0; 12411 } 12412 return env->v7m.psplim[M_REG_NS]; 12413 case 0x90: /* PRIMASK_NS */ 12414 if (!env->v7m.secure) { 12415 return 0; 12416 } 12417 return env->v7m.primask[M_REG_NS]; 12418 case 0x91: /* BASEPRI_NS */ 12419 if (!env->v7m.secure) { 12420 return 0; 12421 } 12422 return env->v7m.basepri[M_REG_NS]; 12423 case 0x93: /* FAULTMASK_NS */ 12424 if (!env->v7m.secure) { 12425 return 0; 12426 } 12427 return env->v7m.faultmask[M_REG_NS]; 12428 case 0x98: /* SP_NS */ 12429 { 12430 /* This gives the non-secure SP selected based on whether we're 12431 * currently in handler mode or not, using the NS CONTROL.SPSEL. 12432 */ 12433 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK; 12434 12435 if (!env->v7m.secure) { 12436 return 0; 12437 } 12438 if (!arm_v7m_is_handler_mode(env) && spsel) { 12439 return env->v7m.other_ss_psp; 12440 } else { 12441 return env->v7m.other_ss_msp; 12442 } 12443 } 12444 default: 12445 break; 12446 } 12447 } 12448 12449 switch (reg) { 12450 case 8: /* MSP */ 12451 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13]; 12452 case 9: /* PSP */ 12453 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp; 12454 case 10: /* MSPLIM */ 12455 if (!arm_feature(env, ARM_FEATURE_V8)) { 12456 goto bad_reg; 12457 } 12458 return env->v7m.msplim[env->v7m.secure]; 12459 case 11: /* PSPLIM */ 12460 if (!arm_feature(env, ARM_FEATURE_V8)) { 12461 goto bad_reg; 12462 } 12463 return env->v7m.psplim[env->v7m.secure]; 12464 case 16: /* PRIMASK */ 12465 return env->v7m.primask[env->v7m.secure]; 12466 case 17: /* BASEPRI */ 12467 case 18: /* BASEPRI_MAX */ 12468 return env->v7m.basepri[env->v7m.secure]; 12469 case 19: /* FAULTMASK */ 12470 return env->v7m.faultmask[env->v7m.secure]; 12471 default: 12472 bad_reg: 12473 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special" 12474 " register %d\n", reg); 12475 return 0; 12476 } 12477 } 12478 12479 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) 12480 { 12481 /* We're passed bits [11..0] of the instruction; extract 12482 * SYSm and the mask bits. 12483 * Invalid combinations of SYSm and mask are UNPREDICTABLE; 12484 * we choose to treat them as if the mask bits were valid. 12485 * NB that the pseudocode 'mask' variable is bits [11..10], 12486 * whereas ours is [11..8]. 12487 */ 12488 uint32_t mask = extract32(maskreg, 8, 4); 12489 uint32_t reg = extract32(maskreg, 0, 8); 12490 int cur_el = arm_current_el(env); 12491 12492 if (cur_el == 0 && reg > 7 && reg != 20) { 12493 /* 12494 * only xPSR sub-fields and CONTROL.SFPA may be written by 12495 * unprivileged code 12496 */ 12497 return; 12498 } 12499 12500 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 12501 switch (reg) { 12502 case 0x88: /* MSP_NS */ 12503 if (!env->v7m.secure) { 12504 return; 12505 } 12506 env->v7m.other_ss_msp = val; 12507 return; 12508 case 0x89: /* PSP_NS */ 12509 if (!env->v7m.secure) { 12510 return; 12511 } 12512 env->v7m.other_ss_psp = val; 12513 return; 12514 case 0x8a: /* MSPLIM_NS */ 12515 if (!env->v7m.secure) { 12516 return; 12517 } 12518 env->v7m.msplim[M_REG_NS] = val & ~7; 12519 return; 12520 case 0x8b: /* PSPLIM_NS */ 12521 if (!env->v7m.secure) { 12522 return; 12523 } 12524 env->v7m.psplim[M_REG_NS] = val & ~7; 12525 return; 12526 case 0x90: /* PRIMASK_NS */ 12527 if (!env->v7m.secure) { 12528 return; 12529 } 12530 env->v7m.primask[M_REG_NS] = val & 1; 12531 return; 12532 case 0x91: /* BASEPRI_NS */ 12533 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) { 12534 return; 12535 } 12536 env->v7m.basepri[M_REG_NS] = val & 0xff; 12537 return; 12538 case 0x93: /* FAULTMASK_NS */ 12539 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) { 12540 return; 12541 } 12542 env->v7m.faultmask[M_REG_NS] = val & 1; 12543 return; 12544 case 0x94: /* CONTROL_NS */ 12545 if (!env->v7m.secure) { 12546 return; 12547 } 12548 write_v7m_control_spsel_for_secstate(env, 12549 val & R_V7M_CONTROL_SPSEL_MASK, 12550 M_REG_NS); 12551 if (arm_feature(env, ARM_FEATURE_M_MAIN)) { 12552 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK; 12553 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK; 12554 } 12555 /* 12556 * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0, 12557 * RES0 if the FPU is not present, and is stored in the S bank 12558 */ 12559 if (arm_feature(env, ARM_FEATURE_VFP) && 12560 extract32(env->v7m.nsacr, 10, 1)) { 12561 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK; 12562 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK; 12563 } 12564 return; 12565 case 0x98: /* SP_NS */ 12566 { 12567 /* This gives the non-secure SP selected based on whether we're 12568 * currently in handler mode or not, using the NS CONTROL.SPSEL. 12569 */ 12570 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK; 12571 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel; 12572 uint32_t limit; 12573 12574 if (!env->v7m.secure) { 12575 return; 12576 } 12577 12578 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false]; 12579 12580 if (val < limit) { 12581 CPUState *cs = CPU(arm_env_get_cpu(env)); 12582 12583 cpu_restore_state(cs, GETPC(), true); 12584 raise_exception(env, EXCP_STKOF, 0, 1); 12585 } 12586 12587 if (is_psp) { 12588 env->v7m.other_ss_psp = val; 12589 } else { 12590 env->v7m.other_ss_msp = val; 12591 } 12592 return; 12593 } 12594 default: 12595 break; 12596 } 12597 } 12598 12599 switch (reg) { 12600 case 0 ... 7: /* xPSR sub-fields */ 12601 /* only APSR is actually writable */ 12602 if (!(reg & 4)) { 12603 uint32_t apsrmask = 0; 12604 12605 if (mask & 8) { 12606 apsrmask |= XPSR_NZCV | XPSR_Q; 12607 } 12608 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) { 12609 apsrmask |= XPSR_GE; 12610 } 12611 xpsr_write(env, val, apsrmask); 12612 } 12613 break; 12614 case 8: /* MSP */ 12615 if (v7m_using_psp(env)) { 12616 env->v7m.other_sp = val; 12617 } else { 12618 env->regs[13] = val; 12619 } 12620 break; 12621 case 9: /* PSP */ 12622 if (v7m_using_psp(env)) { 12623 env->regs[13] = val; 12624 } else { 12625 env->v7m.other_sp = val; 12626 } 12627 break; 12628 case 10: /* MSPLIM */ 12629 if (!arm_feature(env, ARM_FEATURE_V8)) { 12630 goto bad_reg; 12631 } 12632 env->v7m.msplim[env->v7m.secure] = val & ~7; 12633 break; 12634 case 11: /* PSPLIM */ 12635 if (!arm_feature(env, ARM_FEATURE_V8)) { 12636 goto bad_reg; 12637 } 12638 env->v7m.psplim[env->v7m.secure] = val & ~7; 12639 break; 12640 case 16: /* PRIMASK */ 12641 env->v7m.primask[env->v7m.secure] = val & 1; 12642 break; 12643 case 17: /* BASEPRI */ 12644 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12645 goto bad_reg; 12646 } 12647 env->v7m.basepri[env->v7m.secure] = val & 0xff; 12648 break; 12649 case 18: /* BASEPRI_MAX */ 12650 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12651 goto bad_reg; 12652 } 12653 val &= 0xff; 12654 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure] 12655 || env->v7m.basepri[env->v7m.secure] == 0)) { 12656 env->v7m.basepri[env->v7m.secure] = val; 12657 } 12658 break; 12659 case 19: /* FAULTMASK */ 12660 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12661 goto bad_reg; 12662 } 12663 env->v7m.faultmask[env->v7m.secure] = val & 1; 12664 break; 12665 case 20: /* CONTROL */ 12666 /* 12667 * Writing to the SPSEL bit only has an effect if we are in 12668 * thread mode; other bits can be updated by any privileged code. 12669 * write_v7m_control_spsel() deals with updating the SPSEL bit in 12670 * env->v7m.control, so we only need update the others. 12671 * For v7M, we must just ignore explicit writes to SPSEL in handler 12672 * mode; for v8M the write is permitted but will have no effect. 12673 * All these bits are writes-ignored from non-privileged code, 12674 * except for SFPA. 12675 */ 12676 if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) || 12677 !arm_v7m_is_handler_mode(env))) { 12678 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0); 12679 } 12680 if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) { 12681 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK; 12682 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK; 12683 } 12684 if (arm_feature(env, ARM_FEATURE_VFP)) { 12685 /* 12686 * SFPA is RAZ/WI from NS or if no FPU. 12687 * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present. 12688 * Both are stored in the S bank. 12689 */ 12690 if (env->v7m.secure) { 12691 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 12692 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK; 12693 } 12694 if (cur_el > 0 && 12695 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) || 12696 extract32(env->v7m.nsacr, 10, 1))) { 12697 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK; 12698 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK; 12699 } 12700 } 12701 break; 12702 default: 12703 bad_reg: 12704 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special" 12705 " register %d\n", reg); 12706 return; 12707 } 12708 } 12709 12710 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) 12711 { 12712 /* Implement the TT instruction. op is bits [7:6] of the insn. */ 12713 bool forceunpriv = op & 1; 12714 bool alt = op & 2; 12715 V8M_SAttributes sattrs = {}; 12716 uint32_t tt_resp; 12717 bool r, rw, nsr, nsrw, mrvalid; 12718 int prot; 12719 ARMMMUFaultInfo fi = {}; 12720 MemTxAttrs attrs = {}; 12721 hwaddr phys_addr; 12722 ARMMMUIdx mmu_idx; 12723 uint32_t mregion; 12724 bool targetpriv; 12725 bool targetsec = env->v7m.secure; 12726 bool is_subpage; 12727 12728 /* Work out what the security state and privilege level we're 12729 * interested in is... 12730 */ 12731 if (alt) { 12732 targetsec = !targetsec; 12733 } 12734 12735 if (forceunpriv) { 12736 targetpriv = false; 12737 } else { 12738 targetpriv = arm_v7m_is_handler_mode(env) || 12739 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK); 12740 } 12741 12742 /* ...and then figure out which MMU index this is */ 12743 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv); 12744 12745 /* We know that the MPU and SAU don't care about the access type 12746 * for our purposes beyond that we don't want to claim to be 12747 * an insn fetch, so we arbitrarily call this a read. 12748 */ 12749 12750 /* MPU region info only available for privileged or if 12751 * inspecting the other MPU state. 12752 */ 12753 if (arm_current_el(env) != 0 || alt) { 12754 /* We can ignore the return value as prot is always set */ 12755 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, 12756 &phys_addr, &attrs, &prot, &is_subpage, 12757 &fi, &mregion); 12758 if (mregion == -1) { 12759 mrvalid = false; 12760 mregion = 0; 12761 } else { 12762 mrvalid = true; 12763 } 12764 r = prot & PAGE_READ; 12765 rw = prot & PAGE_WRITE; 12766 } else { 12767 r = false; 12768 rw = false; 12769 mrvalid = false; 12770 mregion = 0; 12771 } 12772 12773 if (env->v7m.secure) { 12774 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs); 12775 nsr = sattrs.ns && r; 12776 nsrw = sattrs.ns && rw; 12777 } else { 12778 sattrs.ns = true; 12779 nsr = false; 12780 nsrw = false; 12781 } 12782 12783 tt_resp = (sattrs.iregion << 24) | 12784 (sattrs.irvalid << 23) | 12785 ((!sattrs.ns) << 22) | 12786 (nsrw << 21) | 12787 (nsr << 20) | 12788 (rw << 19) | 12789 (r << 18) | 12790 (sattrs.srvalid << 17) | 12791 (mrvalid << 16) | 12792 (sattrs.sregion << 8) | 12793 mregion; 12794 12795 return tt_resp; 12796 } 12797 12798 #endif 12799 12800 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in) 12801 { 12802 /* Implement DC ZVA, which zeroes a fixed-length block of memory. 12803 * Note that we do not implement the (architecturally mandated) 12804 * alignment fault for attempts to use this on Device memory 12805 * (which matches the usual QEMU behaviour of not implementing either 12806 * alignment faults or any memory attribute handling). 12807 */ 12808 12809 ARMCPU *cpu = arm_env_get_cpu(env); 12810 uint64_t blocklen = 4 << cpu->dcz_blocksize; 12811 uint64_t vaddr = vaddr_in & ~(blocklen - 1); 12812 12813 #ifndef CONFIG_USER_ONLY 12814 { 12815 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than 12816 * the block size so we might have to do more than one TLB lookup. 12817 * We know that in fact for any v8 CPU the page size is at least 4K 12818 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only 12819 * 1K as an artefact of legacy v5 subpage support being present in the 12820 * same QEMU executable. 12821 */ 12822 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE); 12823 void *hostaddr[maxidx]; 12824 int try, i; 12825 unsigned mmu_idx = cpu_mmu_index(env, false); 12826 TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); 12827 12828 for (try = 0; try < 2; try++) { 12829 12830 for (i = 0; i < maxidx; i++) { 12831 hostaddr[i] = tlb_vaddr_to_host(env, 12832 vaddr + TARGET_PAGE_SIZE * i, 12833 1, mmu_idx); 12834 if (!hostaddr[i]) { 12835 break; 12836 } 12837 } 12838 if (i == maxidx) { 12839 /* If it's all in the TLB it's fair game for just writing to; 12840 * we know we don't need to update dirty status, etc. 12841 */ 12842 for (i = 0; i < maxidx - 1; i++) { 12843 memset(hostaddr[i], 0, TARGET_PAGE_SIZE); 12844 } 12845 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE)); 12846 return; 12847 } 12848 /* OK, try a store and see if we can populate the tlb. This 12849 * might cause an exception if the memory isn't writable, 12850 * in which case we will longjmp out of here. We must for 12851 * this purpose use the actual register value passed to us 12852 * so that we get the fault address right. 12853 */ 12854 helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETPC()); 12855 /* Now we can populate the other TLB entries, if any */ 12856 for (i = 0; i < maxidx; i++) { 12857 uint64_t va = vaddr + TARGET_PAGE_SIZE * i; 12858 if (va != (vaddr_in & TARGET_PAGE_MASK)) { 12859 helper_ret_stb_mmu(env, va, 0, oi, GETPC()); 12860 } 12861 } 12862 } 12863 12864 /* Slow path (probably attempt to do this to an I/O device or 12865 * similar, or clearing of a block of code we have translations 12866 * cached for). Just do a series of byte writes as the architecture 12867 * demands. It's not worth trying to use a cpu_physical_memory_map(), 12868 * memset(), unmap() sequence here because: 12869 * + we'd need to account for the blocksize being larger than a page 12870 * + the direct-RAM access case is almost always going to be dealt 12871 * with in the fastpath code above, so there's no speed benefit 12872 * + we would have to deal with the map returning NULL because the 12873 * bounce buffer was in use 12874 */ 12875 for (i = 0; i < blocklen; i++) { 12876 helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETPC()); 12877 } 12878 } 12879 #else 12880 memset(g2h(vaddr), 0, blocklen); 12881 #endif 12882 } 12883 12884 /* Note that signed overflow is undefined in C. The following routines are 12885 careful to use unsigned types where modulo arithmetic is required. 12886 Failure to do so _will_ break on newer gcc. */ 12887 12888 /* Signed saturating arithmetic. */ 12889 12890 /* Perform 16-bit signed saturating addition. */ 12891 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 12892 { 12893 uint16_t res; 12894 12895 res = a + b; 12896 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 12897 if (a & 0x8000) 12898 res = 0x8000; 12899 else 12900 res = 0x7fff; 12901 } 12902 return res; 12903 } 12904 12905 /* Perform 8-bit signed saturating addition. */ 12906 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 12907 { 12908 uint8_t res; 12909 12910 res = a + b; 12911 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 12912 if (a & 0x80) 12913 res = 0x80; 12914 else 12915 res = 0x7f; 12916 } 12917 return res; 12918 } 12919 12920 /* Perform 16-bit signed saturating subtraction. */ 12921 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 12922 { 12923 uint16_t res; 12924 12925 res = a - b; 12926 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 12927 if (a & 0x8000) 12928 res = 0x8000; 12929 else 12930 res = 0x7fff; 12931 } 12932 return res; 12933 } 12934 12935 /* Perform 8-bit signed saturating subtraction. */ 12936 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 12937 { 12938 uint8_t res; 12939 12940 res = a - b; 12941 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 12942 if (a & 0x80) 12943 res = 0x80; 12944 else 12945 res = 0x7f; 12946 } 12947 return res; 12948 } 12949 12950 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 12951 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 12952 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 12953 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 12954 #define PFX q 12955 12956 #include "op_addsub.h" 12957 12958 /* Unsigned saturating arithmetic. */ 12959 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 12960 { 12961 uint16_t res; 12962 res = a + b; 12963 if (res < a) 12964 res = 0xffff; 12965 return res; 12966 } 12967 12968 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 12969 { 12970 if (a > b) 12971 return a - b; 12972 else 12973 return 0; 12974 } 12975 12976 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 12977 { 12978 uint8_t res; 12979 res = a + b; 12980 if (res < a) 12981 res = 0xff; 12982 return res; 12983 } 12984 12985 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 12986 { 12987 if (a > b) 12988 return a - b; 12989 else 12990 return 0; 12991 } 12992 12993 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 12994 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 12995 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 12996 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 12997 #define PFX uq 12998 12999 #include "op_addsub.h" 13000 13001 /* Signed modulo arithmetic. */ 13002 #define SARITH16(a, b, n, op) do { \ 13003 int32_t sum; \ 13004 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 13005 RESULT(sum, n, 16); \ 13006 if (sum >= 0) \ 13007 ge |= 3 << (n * 2); \ 13008 } while(0) 13009 13010 #define SARITH8(a, b, n, op) do { \ 13011 int32_t sum; \ 13012 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 13013 RESULT(sum, n, 8); \ 13014 if (sum >= 0) \ 13015 ge |= 1 << n; \ 13016 } while(0) 13017 13018 13019 #define ADD16(a, b, n) SARITH16(a, b, n, +) 13020 #define SUB16(a, b, n) SARITH16(a, b, n, -) 13021 #define ADD8(a, b, n) SARITH8(a, b, n, +) 13022 #define SUB8(a, b, n) SARITH8(a, b, n, -) 13023 #define PFX s 13024 #define ARITH_GE 13025 13026 #include "op_addsub.h" 13027 13028 /* Unsigned modulo arithmetic. */ 13029 #define ADD16(a, b, n) do { \ 13030 uint32_t sum; \ 13031 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 13032 RESULT(sum, n, 16); \ 13033 if ((sum >> 16) == 1) \ 13034 ge |= 3 << (n * 2); \ 13035 } while(0) 13036 13037 #define ADD8(a, b, n) do { \ 13038 uint32_t sum; \ 13039 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 13040 RESULT(sum, n, 8); \ 13041 if ((sum >> 8) == 1) \ 13042 ge |= 1 << n; \ 13043 } while(0) 13044 13045 #define SUB16(a, b, n) do { \ 13046 uint32_t sum; \ 13047 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 13048 RESULT(sum, n, 16); \ 13049 if ((sum >> 16) == 0) \ 13050 ge |= 3 << (n * 2); \ 13051 } while(0) 13052 13053 #define SUB8(a, b, n) do { \ 13054 uint32_t sum; \ 13055 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 13056 RESULT(sum, n, 8); \ 13057 if ((sum >> 8) == 0) \ 13058 ge |= 1 << n; \ 13059 } while(0) 13060 13061 #define PFX u 13062 #define ARITH_GE 13063 13064 #include "op_addsub.h" 13065 13066 /* Halved signed arithmetic. */ 13067 #define ADD16(a, b, n) \ 13068 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 13069 #define SUB16(a, b, n) \ 13070 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 13071 #define ADD8(a, b, n) \ 13072 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 13073 #define SUB8(a, b, n) \ 13074 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 13075 #define PFX sh 13076 13077 #include "op_addsub.h" 13078 13079 /* Halved unsigned arithmetic. */ 13080 #define ADD16(a, b, n) \ 13081 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 13082 #define SUB16(a, b, n) \ 13083 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 13084 #define ADD8(a, b, n) \ 13085 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 13086 #define SUB8(a, b, n) \ 13087 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 13088 #define PFX uh 13089 13090 #include "op_addsub.h" 13091 13092 static inline uint8_t do_usad(uint8_t a, uint8_t b) 13093 { 13094 if (a > b) 13095 return a - b; 13096 else 13097 return b - a; 13098 } 13099 13100 /* Unsigned sum of absolute byte differences. */ 13101 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 13102 { 13103 uint32_t sum; 13104 sum = do_usad(a, b); 13105 sum += do_usad(a >> 8, b >> 8); 13106 sum += do_usad(a >> 16, b >>16); 13107 sum += do_usad(a >> 24, b >> 24); 13108 return sum; 13109 } 13110 13111 /* For ARMv6 SEL instruction. */ 13112 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 13113 { 13114 uint32_t mask; 13115 13116 mask = 0; 13117 if (flags & 1) 13118 mask |= 0xff; 13119 if (flags & 2) 13120 mask |= 0xff00; 13121 if (flags & 4) 13122 mask |= 0xff0000; 13123 if (flags & 8) 13124 mask |= 0xff000000; 13125 return (a & mask) | (b & ~mask); 13126 } 13127 13128 /* CRC helpers. 13129 * The upper bytes of val (above the number specified by 'bytes') must have 13130 * been zeroed out by the caller. 13131 */ 13132 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 13133 { 13134 uint8_t buf[4]; 13135 13136 stl_le_p(buf, val); 13137 13138 /* zlib crc32 converts the accumulator and output to one's complement. */ 13139 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 13140 } 13141 13142 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 13143 { 13144 uint8_t buf[4]; 13145 13146 stl_le_p(buf, val); 13147 13148 /* Linux crc32c converts the output to one's complement. */ 13149 return crc32c(acc, buf, bytes) ^ 0xffffffff; 13150 } 13151 13152 /* Return the exception level to which FP-disabled exceptions should 13153 * be taken, or 0 if FP is enabled. 13154 */ 13155 int fp_exception_el(CPUARMState *env, int cur_el) 13156 { 13157 #ifndef CONFIG_USER_ONLY 13158 int fpen; 13159 13160 /* CPACR and the CPTR registers don't exist before v6, so FP is 13161 * always accessible 13162 */ 13163 if (!arm_feature(env, ARM_FEATURE_V6)) { 13164 return 0; 13165 } 13166 13167 if (arm_feature(env, ARM_FEATURE_M)) { 13168 /* CPACR can cause a NOCP UsageFault taken to current security state */ 13169 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) { 13170 return 1; 13171 } 13172 13173 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) { 13174 if (!extract32(env->v7m.nsacr, 10, 1)) { 13175 /* FP insns cause a NOCP UsageFault taken to Secure */ 13176 return 3; 13177 } 13178 } 13179 13180 return 0; 13181 } 13182 13183 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit: 13184 * 0, 2 : trap EL0 and EL1/PL1 accesses 13185 * 1 : trap only EL0 accesses 13186 * 3 : trap no accesses 13187 */ 13188 fpen = extract32(env->cp15.cpacr_el1, 20, 2); 13189 switch (fpen) { 13190 case 0: 13191 case 2: 13192 if (cur_el == 0 || cur_el == 1) { 13193 /* Trap to PL1, which might be EL1 or EL3 */ 13194 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) { 13195 return 3; 13196 } 13197 return 1; 13198 } 13199 if (cur_el == 3 && !is_a64(env)) { 13200 /* Secure PL1 running at EL3 */ 13201 return 3; 13202 } 13203 break; 13204 case 1: 13205 if (cur_el == 0) { 13206 return 1; 13207 } 13208 break; 13209 case 3: 13210 break; 13211 } 13212 13213 /* For the CPTR registers we don't need to guard with an ARM_FEATURE 13214 * check because zero bits in the registers mean "don't trap". 13215 */ 13216 13217 /* CPTR_EL2 : present in v7VE or v8 */ 13218 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1) 13219 && !arm_is_secure_below_el3(env)) { 13220 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */ 13221 return 2; 13222 } 13223 13224 /* CPTR_EL3 : present in v8 */ 13225 if (extract32(env->cp15.cptr_el[3], 10, 1)) { 13226 /* Trap all FP ops to EL3 */ 13227 return 3; 13228 } 13229 #endif 13230 return 0; 13231 } 13232 13233 ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env, 13234 bool secstate, bool priv, bool negpri) 13235 { 13236 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M; 13237 13238 if (priv) { 13239 mmu_idx |= ARM_MMU_IDX_M_PRIV; 13240 } 13241 13242 if (negpri) { 13243 mmu_idx |= ARM_MMU_IDX_M_NEGPRI; 13244 } 13245 13246 if (secstate) { 13247 mmu_idx |= ARM_MMU_IDX_M_S; 13248 } 13249 13250 return mmu_idx; 13251 } 13252 13253 ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env, 13254 bool secstate, bool priv) 13255 { 13256 bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate); 13257 13258 return arm_v7m_mmu_idx_all(env, secstate, priv, negpri); 13259 } 13260 13261 /* Return the MMU index for a v7M CPU in the specified security state */ 13262 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 13263 { 13264 bool priv = arm_current_el(env) != 0; 13265 13266 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv); 13267 } 13268 13269 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 13270 { 13271 int el; 13272 13273 if (arm_feature(env, ARM_FEATURE_M)) { 13274 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 13275 } 13276 13277 el = arm_current_el(env); 13278 if (el < 2 && arm_is_secure_below_el3(env)) { 13279 return ARMMMUIdx_S1SE0 + el; 13280 } else { 13281 return ARMMMUIdx_S12NSE0 + el; 13282 } 13283 } 13284 13285 int cpu_mmu_index(CPUARMState *env, bool ifetch) 13286 { 13287 return arm_to_core_mmu_idx(arm_mmu_idx(env)); 13288 } 13289 13290 #ifndef CONFIG_USER_ONLY 13291 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 13292 { 13293 return stage_1_mmu_idx(arm_mmu_idx(env)); 13294 } 13295 #endif 13296 13297 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 13298 target_ulong *cs_base, uint32_t *pflags) 13299 { 13300 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 13301 int current_el = arm_current_el(env); 13302 int fp_el = fp_exception_el(env, current_el); 13303 uint32_t flags = 0; 13304 13305 if (is_a64(env)) { 13306 ARMCPU *cpu = arm_env_get_cpu(env); 13307 uint64_t sctlr; 13308 13309 *pc = env->pc; 13310 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1); 13311 13312 /* Get control bits for tagged addresses. */ 13313 { 13314 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx); 13315 ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1); 13316 int tbii, tbid; 13317 13318 /* FIXME: ARMv8.1-VHE S2 translation regime. */ 13319 if (regime_el(env, stage1) < 2) { 13320 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1); 13321 tbid = (p1.tbi << 1) | p0.tbi; 13322 tbii = tbid & ~((p1.tbid << 1) | p0.tbid); 13323 } else { 13324 tbid = p0.tbi; 13325 tbii = tbid & !p0.tbid; 13326 } 13327 13328 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii); 13329 flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid); 13330 } 13331 13332 if (cpu_isar_feature(aa64_sve, cpu)) { 13333 int sve_el = sve_exception_el(env, current_el); 13334 uint32_t zcr_len; 13335 13336 /* If SVE is disabled, but FP is enabled, 13337 * then the effective len is 0. 13338 */ 13339 if (sve_el != 0 && fp_el == 0) { 13340 zcr_len = 0; 13341 } else { 13342 zcr_len = sve_zcr_len_for_el(env, current_el); 13343 } 13344 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el); 13345 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len); 13346 } 13347 13348 sctlr = arm_sctlr(env, current_el); 13349 13350 if (cpu_isar_feature(aa64_pauth, cpu)) { 13351 /* 13352 * In order to save space in flags, we record only whether 13353 * pauth is "inactive", meaning all insns are implemented as 13354 * a nop, or "active" when some action must be performed. 13355 * The decision of which action to take is left to a helper. 13356 */ 13357 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) { 13358 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1); 13359 } 13360 } 13361 13362 if (cpu_isar_feature(aa64_bti, cpu)) { 13363 /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */ 13364 if (sctlr & (current_el == 0 ? SCTLR_BT0 : SCTLR_BT1)) { 13365 flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1); 13366 } 13367 flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype); 13368 } 13369 } else { 13370 *pc = env->regs[15]; 13371 flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb); 13372 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, env->vfp.vec_len); 13373 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, env->vfp.vec_stride); 13374 flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits); 13375 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, arm_sctlr_b(env)); 13376 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env)); 13377 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30) 13378 || arm_el_is_aa64(env, 1) || arm_feature(env, ARM_FEATURE_M)) { 13379 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 13380 } 13381 /* Note that XSCALE_CPAR shares bits with VECSTRIDE */ 13382 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 13383 flags = FIELD_DP32(flags, TBFLAG_A32, 13384 XSCALE_CPAR, env->cp15.c15_cpar); 13385 } 13386 } 13387 13388 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, arm_to_core_mmu_idx(mmu_idx)); 13389 13390 /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 13391 * states defined in the ARM ARM for software singlestep: 13392 * SS_ACTIVE PSTATE.SS State 13393 * 0 x Inactive (the TB flag for SS is always 0) 13394 * 1 0 Active-pending 13395 * 1 1 Active-not-pending 13396 */ 13397 if (arm_singlestep_active(env)) { 13398 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1); 13399 if (is_a64(env)) { 13400 if (env->pstate & PSTATE_SS) { 13401 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 13402 } 13403 } else { 13404 if (env->uncached_cpsr & PSTATE_SS) { 13405 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 13406 } 13407 } 13408 } 13409 if (arm_cpu_data_is_big_endian(env)) { 13410 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 13411 } 13412 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el); 13413 13414 if (arm_v7m_is_handler_mode(env)) { 13415 flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1); 13416 } 13417 13418 /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is 13419 * suppressing them because the requested execution priority is less than 0. 13420 */ 13421 if (arm_feature(env, ARM_FEATURE_V8) && 13422 arm_feature(env, ARM_FEATURE_M) && 13423 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) && 13424 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) { 13425 flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1); 13426 } 13427 13428 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 13429 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) != env->v7m.secure) { 13430 flags = FIELD_DP32(flags, TBFLAG_A32, FPCCR_S_WRONG, 1); 13431 } 13432 13433 if (arm_feature(env, ARM_FEATURE_M) && 13434 (env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) && 13435 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) || 13436 (env->v7m.secure && 13437 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) { 13438 /* 13439 * ASPEN is set, but FPCA/SFPA indicate that there is no active 13440 * FP context; we must create a new FP context before executing 13441 * any FP insn. 13442 */ 13443 flags = FIELD_DP32(flags, TBFLAG_A32, NEW_FP_CTXT_NEEDED, 1); 13444 } 13445 13446 *pflags = flags; 13447 *cs_base = 0; 13448 } 13449 13450 #ifdef TARGET_AARCH64 13451 /* 13452 * The manual says that when SVE is enabled and VQ is widened the 13453 * implementation is allowed to zero the previously inaccessible 13454 * portion of the registers. The corollary to that is that when 13455 * SVE is enabled and VQ is narrowed we are also allowed to zero 13456 * the now inaccessible portion of the registers. 13457 * 13458 * The intent of this is that no predicate bit beyond VQ is ever set. 13459 * Which means that some operations on predicate registers themselves 13460 * may operate on full uint64_t or even unrolled across the maximum 13461 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 13462 * may well be cheaper than conditionals to restrict the operation 13463 * to the relevant portion of a uint16_t[16]. 13464 */ 13465 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 13466 { 13467 int i, j; 13468 uint64_t pmask; 13469 13470 assert(vq >= 1 && vq <= ARM_MAX_VQ); 13471 assert(vq <= arm_env_get_cpu(env)->sve_max_vq); 13472 13473 /* Zap the high bits of the zregs. */ 13474 for (i = 0; i < 32; i++) { 13475 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 13476 } 13477 13478 /* Zap the high bits of the pregs and ffr. */ 13479 pmask = 0; 13480 if (vq & 3) { 13481 pmask = ~(-1ULL << (16 * (vq & 3))); 13482 } 13483 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 13484 for (i = 0; i < 17; ++i) { 13485 env->vfp.pregs[i].p[j] &= pmask; 13486 } 13487 pmask = 0; 13488 } 13489 } 13490 13491 /* 13492 * Notice a change in SVE vector size when changing EL. 13493 */ 13494 void aarch64_sve_change_el(CPUARMState *env, int old_el, 13495 int new_el, bool el0_a64) 13496 { 13497 ARMCPU *cpu = arm_env_get_cpu(env); 13498 int old_len, new_len; 13499 bool old_a64, new_a64; 13500 13501 /* Nothing to do if no SVE. */ 13502 if (!cpu_isar_feature(aa64_sve, cpu)) { 13503 return; 13504 } 13505 13506 /* Nothing to do if FP is disabled in either EL. */ 13507 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 13508 return; 13509 } 13510 13511 /* 13512 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 13513 * at ELx, or not available because the EL is in AArch32 state, then 13514 * for all purposes other than a direct read, the ZCR_ELx.LEN field 13515 * has an effective value of 0". 13516 * 13517 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 13518 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 13519 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 13520 * we already have the correct register contents when encountering the 13521 * vq0->vq0 transition between EL0->EL1. 13522 */ 13523 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 13524 old_len = (old_a64 && !sve_exception_el(env, old_el) 13525 ? sve_zcr_len_for_el(env, old_el) : 0); 13526 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 13527 new_len = (new_a64 && !sve_exception_el(env, new_el) 13528 ? sve_zcr_len_for_el(env, new_el) : 0); 13529 13530 /* When changing vector length, clear inaccessible state. */ 13531 if (new_len < old_len) { 13532 aarch64_sve_narrow_vq(env, new_len + 1); 13533 } 13534 } 13535 #endif 13536